Splunk Splunk Certifications SPLK-2003 Questions & Answers

• Question 91:

  Which of the following supported approaches enables Phantom to run on a Windows server?

  A. Install the Phantom RPM in a GNU Cygwin implementation.

  B. Run the Phantom OVA as a cloud instance.

  C. Install the Phantom RPM file in Windows Subsystem for Linux (WSL).

  D. Run the Phantom OVA as a virtual machine.

  Correct Answer: D

  Splunk SOAR (formerly Phantom) does not natively run on Windows servers as it is primarily designed for Linux environments. However, it can be deployed on a Windows server through virtualization. By running the Phantom OVA (Open Virtualization Appliance) as a virtual machine, users can utilize virtualization platforms like VMware or VirtualBox on a Windows server to host the Phantom environment. This approach allows for the deployment of Phantom in a Windows-centric infrastructure by leveraging virtualization technology to encapsulate the Phantom application within a supported Linux environment provided by the OVA.

• Question 92:

  Which of the following can be configured in the ROI Settings?

  A. Number of full time employees (FTEs).

  B. Time lost.

  C. Analyst hours per month.

  D. Annual analyst salary.

  Correct Answer: C

  ROI Settings dashboard allows you to configure the parameters used to estimate the data displayed in the Automation ROI Summary dashboard. One of the settings that can be configured is the FTE Gained, which is the number of full time employees (FTEs) that are freed up by automation. To calculate this value, Splunk SOAR divides the number of actions run by automation by the number of expected actions an analyst would take, based on minutes per action and analyst hours per day. Therefore, option A is the correct answer, as it is one of the settings that can be configured in the ROI Settings dashboard. Option B is incorrect, because time lost is not a setting that can be configured in the ROI Settings dashboard, but a metric that is calculated by Splunk SOAR based on the difference between the analyst minutes per action and the actual minutes per action. Option C is incorrect, because analyst hours per month is not a setting that can be configured in the ROI Settings dashboard, but a value that is derived from the analyst hours per day setting. Option D is incorrect, because annual analyst salary is a setting that can be configured in the ROI Settings dashboard, but not the one that is asked in the question.

  1: Configure the ROI Settings dashboard in Administer Splunk SOAR (On-premises) ROI (Return on Investment) Settings within Splunk SOAR are used to estimate the efficiency and financial impact of the SOAR platform. One of the configurable parameters in these settings is the 'Analyst hours per month'. This parameter helps in calculating the time saved through automation, which in turn can be translated into cost savings and efficiency gains. It reflects the direct contribution of the SOAR platform to operational productivity.

• Question 93:

  What does a user need to do to have a container with an event from Splunk use context- aware actions designed for notable events?

  A. Include the notable event's event_id field and set the artifacts label to aplunk notable event id.

  B. Rename the event_id field from the notable event to splunkNotableEventld.

  C. Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.

  D. Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.

  Correct Answer: C

  For a container in Splunk SOAR to utilize context-aware actions designed for notable events from Splunk, it is crucial to ensure that the notable event's unique identifier ( event_id) is included in the search results pulled into SOAR. Moreover, by adding a Common Event Format (CEF) definition for the event_id field within Phantom, and setting its data type to something that denotes it as a Splunk notable event ID, SOAR can recognize and appropriately handle these identifiers. This setup facilitates the correct mapping and processing of notable event data within SOAR, enabling the execution of context-aware actions that are specifically tailored to the characteristics of Splunk notable events.

• Question 94:

  Where can the Splunk App for SOAR Export be downloaded from?

  A. GitHub and Splunkbase.

  B. SOAR Community and GitHub.

  C. Splunkbase and SOAR Community.

  D. Splunk Answers and Splunkbase.

  Correct Answer: C

  The Splunk App for SOAR Export can typically be downloaded from Splunkbase, which is Splunk's marketplace for apps and add-ons. Additionally, it can often be found within the SOAR Community site, where users can share and access apps, playbooks, and other resources created for the Splunk SOAR ecosystem. These platforms provide trusted sources for downloading the app, ensuring compatibility and support.

  Splunk App for SOAR Export can be downloaded from two sources: Splunkbase and SOAR Community. Splunkbase is the official repository of Splunk apps and add-ons, where you can find the latest version of the Splunk App for SOAR Export, along with its documentation, release notes, and ratings2. SOAR Community is the online forum for Splunk SOAR users and developers, where you can find the Splunk App for SOAR Export, along with other useful resources, such as FAQs, tips, and best practices3. Therefore, option C is the correct answer, as it lists the two sources where the Splunk App for SOAR Export can be downloaded from. Option A is incorrect, because GitHub is not a source where the Splunk App for SOAR Export can be downloaded from, but rather a platform for hosting and managing code repositories. Option B is incorrect, for the same reason as option A. Option D is incorrect, because Splunk Answers is not a source where the Splunk App for SOAR Export can be downloaded from, but rather a platform for asking and answering questions about Splunk products and services.

  1: Web search results from search_web(query="Splunk SOAR Automation Developer Splunk App for SOAR Export") 2: Splunk App for SOAR Export | Splunkbase 3: SOAR Community - Splunk App for SOAR Export

• Question 95:

  Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

  A. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)

  B. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

  C. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

  D. SplunkWeb (8469), SplunkD (8702), HTTP Collector (8864)

  Correct Answer: C

  For Splunk SOAR to connect with Splunk Enterprise, certain default ports must be configured to facilitate communication between the two platforms. Typically, SplunkWeb, which serves the Splunk Enterprise web interface, uses port 8000. SplunkD, the Splunk daemon that handles most of the back-end services, listens on port 8089. The HTTP Event Collector (HEC), which allows HTTP clients to send data to Splunk, typically uses port 8088. These ports are essential for the integration, allowing SOAR to send data to Splunk for indexing, searching, and visualization. Options A, B, and D list incorrect port configurations for this purpose, making option C the correct answer based on standard Splunk configurations. These are the default ports used by Splunk SOAR (On-premises) to communicate with the embedded Splunk Enterprise instance. SplunkWeb is the web interface for Splunk Enterprise, SplunkD is the management port for Splunk Enterprise, and HTTP Collector is the port for receiving data from HTTP Event Collector (HEC). The other options are either incorrect or not default ports. For example, option B has the SplunkWeb and SplunkD ports reversed, and option D has arbitrary port numbers that are not used by Splunk by default.

• Question 96:

  In a playbook, more than one Action block can be active at one time. What is this called?

  A. Serial Processing

  B. Parallel Processing

  C. Multithreaded Processing

  D. Juggle Processing

  Correct Answer: B

  In Splunk SOAR, when a playbook is designed such that more than one Action block is active at the same time, it is referred to as 'Parallel Processing'. This allows for multiple actions to be executed concurrently, which can significantly speed up the execution of a playbook as it does not have to wait for one action to complete before starting another. Parallel processing enables more efficient use of resources and time, particularly in complex playbooks that perform numerous actions.