Free Splunk SPLK-2003 Exam Dumps Questions & Answers

What are the differences between cases and events?

• A.Cases: only include high-level incident artifacts.
  Events: only include low-level incident artifacts.
• B.Case: potential threats.
  Events: identified as a specific kind of problem and need a structured approach.
• C.Cases: contain a collection of containers.
  Events: contain potential threats.
• D.Cases: incidents with a known violation and a plan for correction.
  Events: occurrences in the system that may require a response.

How can the DECIDED process be restarted?

• A.On the System Health page.
• B.By restarting the automation service.
• C.In Administration > Server Settings.
• D.By restarting the playbook daemon.

What is the simplest way to pass data between playbooks?

• A.Action results
• B.File system
• C.KV Store
• D.Artifacts

How does a user determine which app actions are available?

• A.In the visual playbook editor, click Active and click the Available App Actions dropdown.
• B.From the Apps menu, click the supported actions dropdown for each app.
• C.Add an action block to a playbook canvas area.
• D.Search the Apps category in the global search field.

What is the default embedded search engine used by Phantom?

• A.Embedded Splunk search engine.
• B.Embedded Phantom search engine.
• C.Embedded Elastic search engine.
• D.Embedded Django search engine.