SPLK-2003試験無料問題集（122題）「Splunk Phantom Certified Admin 認定」

出題：1

Which of the following can the format block be used for?

A. To create text strings that merge state text with dynamic values for input or output.

B. To generate arrays for input into other functions.

C. To generate HTML or CSS content for output in email messages, user prompts, or comments.

D. To generate string parameters for automated action blocks.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

What are the components of the I2A2 design methodology?

A. Inputs, Interactions, Actions, Artifacts

B. Inputs, Interactions, Actions, Assets

C. Inputs, Interactions, Actions, Apps

D. Inputs, Interactions, Apps, Artifacts

正解：A 解答を投票する

出題：3

Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?

A. One.

B. Labels are not configured under Asset Ingestion Settings.

C. One or more.

D. Zero or more.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

A. The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.

B. The existing content indexes on the SOAR server need to be re-indexed to migrate them to Splunk.

C. The remote Splunk search head is currently offline.

D. Content that existed before configuring external search must be backed up on SOAR and restored on the Splunk search head.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which of the following can be done with the System Health Display?

A. Partially rewind processes, which is useful for debugging.

B. View a single column of status for SOAR processes. For metrics, click Details.

C. Reset DECIDED to reset playbook environments back to at-start conditions.

D. Create a temporary, edited version of a process and test the results.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

Which set of steps will show the most detailed information for action results on the Investigation page?

A. Clicking the arrow next to the action within the recent activities pane.

B. Clicking on the action within the recent activity pane.

C. Viewing the action widget within the main display area.

D. Viewing the evidence tab within the main display area.

正解：A 解答を投票する

出題：7

After a playbook has run, where are the results stored?

A. Container

B. Splunk Index

C. Case

D. Log file

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

How is a Django filter query performed?

A. phantom/rest/search/app/contains/"sumo"

B. Install the SOAR Django App first, then configure the search query in the App editor.

C. By adding parameters to the URL similar to the following:
phantom/rest/container?_filter_tags_contains="sumo".

D. Browse to the Django Filter Query Editor in the Administration panel.

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

Within the 12A2 design methodology, which of the following most accurately describes the last step?

A. List of the apps used by the playbook.

B. List of the outputs of the playbook design.

C. List of the data needed to run the playbook.

D. List of the actions of the playbook design.

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

Which two playbook blocks can discern which path in the playbook to take next?

A. Prompt and decision blocks.

B. Decision and action blocks.

C. Filter and prompt blocks.

D. Filter and decision blocks.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

SPLK-2003試験無料問題集「Splunk Phantom Certified Admin 認定」