Online Access Free SPLK-2003 Exam Questions

Which of the following is an asset ingestion setting in SOAR?

• A.Polling Interval
• B.File format
• C.Tag
• D.Operating system

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

• A.Null values
• B.Null IP addresses
• C.Non-null IP addresses
• D.Non-null destinationAddresses

In addition to full backups. Phantom supports what other backup type using backup?

• A.Incremental
• B.Differential
• C.Partial
• D.Snapshot

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

• A.Rename the event_id field from the notable event to splunkNotableEventld.
• B.Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
• C.Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.
• D.Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.

Within the 12A2 design methodology, which of the following most accurately describes the last step?

• A.List of the data needed to run the playbook.
• B.List of the outputs of the playbook design.
• C.List of the actions of the playbook design.
• D.List of the apps used by the playbook.