Explanation
A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit only non-null IP addresses to pass forward to the next block. The !- operator means "is not null". The other options are not valid because they either include null values or other fields than sourceAddress. See Filter block for more details.

Explanation
The correct answer is C because creating artifacts using one playbook and collecting those artifacts in another playbook is a best practice for data sharing across playbooks. Artifacts are data objects that are associated with a container and can be used to store information such as IP addresses, URLs, file hashes, etc. Artifacts can be created using the add artifact action in any playbook block and can be collected using the get artifacts action in the filter block. Artifacts can also be used to trigger active playbooks based on their label or type. See Splunk SOAR Documentation for more details.

Explanation
The correct answer is B because an active playbook can be configured to operate on all containers that share a label. A label is a user-defined attribute that can be applied to containers to group them by a common characteristic, such as source, type, severity, etc. Labels can be used to filter containers and trigger active playbooks based on the label value. See Splunk SOAR Documentation for more details.

Explanation
The correct answer is D because the Phantom OVA can be run as a virtual machine on a Windows server using a hypervisor such as VMware Workstation or Hyper-V. This is the recommended approach for installing Phantom on a Windows server. The answer A is incorrect because the Phantom RPM cannot be installed in a GNU Cygwin implementation, as Cygwin does not support RPM packages. The answer B is incorrect because running the Phantom OVA as a cloud instance does not enable Phantom to run on a Windows server, but on a cloud platform such as AWS or Azure. The answer C is incorrect because the Phantom RPM file cannot be installed in Windows Subsystem for Linux (WSL), as WSL does not support RPM packages.
Reference: Splunk SOAR Installation Guide, page 9.

Explanation
The correct answer is A because using Django queries, using curl to create a container and add artifacts to it, and removing temporary lists are examples of things commonly done with the Phantom REST APP. The Phantom REST APP is a built-in app that allows you to interact with the Phantom server using REST API calls. You can use the run query action to execute Django queries on the Phantom database and return the results as JSON. You can use the curl command to send HTTP requests to the Phantom server and perform various operations, such as creating containers, adding artifacts, running playbooks, etc. You can use the remove list action to delete temporary lists that are no longer needed. See Splunk SOAR Documentation for more details.