Online Access Free SPLK-2003 Exam Questions

The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

• A.The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.
• B.Content that existed before configuring external search must be backed up on SOAR and restored on the Splunk search head.
• C.The existing content indexes on the SOAR server need to be re-indexed to migrate them to Splunk.
• D.The remote Splunk search head is currently offline.

What is the default embedded search engine used by Phantom?

• A.Embedded Phantom search engine.
• B.Embedded Elastic search engine.
• C.Embedded Splunk search engine.
• D.Embedded Django search engine.

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

• A.SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
• B.SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
• C.SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)
• D.SplunkWeb (8469), SplunkD (8702), HTTP Collector (8864)

Which of the following describes the use of labels m Phantom?

• A.Labels control the default seventy, ownership, and sensitivity for the container.
• B.Labels control which apps are allowed to execute actions on the container.
• C.Labels determine the service level agreement (SLA) for a container.
• D.Labels determine which playbook(s) are executed when a container is created.

If no data matches any filter conditions, what is the next block run by the playbook?

• A.The filter block.
• B.The end block.
• C.The start block.
• D.The next block.