Splunk SPLK-2003 Quiz 1 Topic 1 Questions 1-5

Question: 1

How does a user determine which app actions are available?

AAdd an action block to a playbook canvas area.

BSearch the Apps category in the global search field.

CFrom the Apps menu, click the supported actions dropdown for each app.

DIn the visual playbook editor, click Active and click the Available App Actions dropdown.

Show Answer

Question: 2

Within the 12A2 design methodology, which of the following most accurately describes the last step?

AList of the apps used by the playbook.

BList of the actions of the playbook design.

CList of the outputs of the playbook design.

DList of the data needed to run the playbook.

Show Answer

Question: 3

Which of the following is a step when configuring event forwarding from Splunk to Phantom?

AMap CIM to CEF fields.

BCreate a Splunk alert that uses the event_forward.py script to send events to Phantom.

CMap CEF to CIM fields.

DCreate a saved search that generates the JSON for the new container on Phantom.

Show Answer

Question: 4

During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

AThe container has artifacts not parameters.

BThe playbook is using an incorrect container.

CThe playbook debugger's scope is set to new.

DThe playbook debugger's scope is set to all.

Show Answer

Question: 5

What is the main purpose of using a customized workbook?

AWorkbooks automatically implement a customized processing of events using Python code.

BWorkbooks guide user activity and coordination during event analysis and case operations.

CWorkbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.

DWorkbooks may not be customized; only default workbooks are permitted within Phantom.

Show Answer

Splunk SPLK-2003 Quiz:1 Topic:1 Questions:1-5