Question 1

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

Options :

A : Enter the two queries in the asset as comma separated values.

B : Configure the second query in the Phantom app for Splunk.

C : Install a second Splunk app and configure the query in the second app.

D : Configure a second Splunk asset with the second query.

Answer: A

Question 2

Which two playbook blocks can discern which path in the playbook to take next?

Options :

A : Prompt and decision blocks.

B : Decision and action blocks.

C : Filter and decision blocks.

D : Filter and prompt blocks.

Answer: A

Question 3

Configuring SOAR search to use an external Splunk server provides which of the following benefits?

Options :

A : The ability to run more complex reports on SOAR activities.

B : The ability to ingest Splunk notable events into SOAR.

C : The ability to automate Splunk searches within SOAR.

D : The ability to display results as Splunk dashboards within SOAR.

Answer: C

Question 4

Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

Options :

A : Non-Human

B : Automation

C : Automation Engineer

D : Service Account

Answer: B

Question 5

If no data matches any filter conditions, what is the next block run by the playbook?

Options :

A : The end block.

B : The start block.

C : The filter block.

D : The next block.

Answer: D

Higher Test Marks with Free Online SPLK-2003 Exam Practice

Buying Options: