Free Splunk SPLK-2003 Exam Dumps Questions & Answers

In addition to full backups. Phantom supports what other backup type using backup?

• A.Partial
• B.Snapshot
• C.Differential
• D.Incremental

When is using decision blocks most useful?

• A.When modifying downstream data hi one or more paths in the playbook.
• B.When evaluating complex, multi-value results or artifacts.
• C.When processing different data in parallel.
• D.When selecting one (or zero) possible paths in the playbook.

What primary integrations does Splunk SOAR provide for Role administration? (Choose all that apply.)

• A.LDAP
• B.Local Authentication
• C.SAML
• D.OpenID

When writing a custom function that uses regex to extract the domain name from a URL, a user wants to create a new artifact for the extracted domain. Which of the following Python API calls will create a new artifact?

• A.phantom.new_artifact ()
• B.phantom.add_artifact ()
• C.phantom.create_artifact ()
• D.phantom. update ()

Two action blocks, geolocate_ip_1 and file_reputation_2, are connected to a decision block.
Which of the following is a correct configuration for making a decision on the action results from one of the given blocks?

• A.Select parameter set to: geolocate_ip_1:action_result.data.*.country_iso_code; evaluation option set to: in; and the Select Value set to: custom_list:Banned Countries.
• B.Select parameter set to: file_reputation_2:action_result.cef.*.response_code; evaluation option set to: in; and the Select Value set to: United States.
• C.Select parameter set to: file_reputation_2:action_result.data.*.response_code; evaluation option set to: ==; and the Select Value set to: custom_list:Banned Countries.
• D.Select parameter set to: geolocate_ip_1:action_result.cef.*.country_iso_code; evaluation option set to: !=; and the Select Value box left empty.