Splunk Splunk Certifications SPLK-2003 Questions & Answers

• Question 11:

  Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?

  A. Labels are not configured under Asset Ingestion Settings.

  B. One.

  C. One or more.

  D. Zero or more.

  Correct Answer: D

  Under Asset Ingestion Settings in Splunk SOAR, when configuring an asset, the number of labels that must be applied can be zero or more. Labels are optional and are used to categorize data and control access. They are not a requirement under Asset Ingestion Settings, but they can be used to enhance organization and filtering if chosen.

• Question 12:

  If no data matches any filter conditions, what is the next block run by the playbook?

  A. The end block.

  B. The start block.

  C. The filter block.

  D. The next block.

  Correct Answer: A

  In Splunk SOAR (formerly Phantom), when a playbook is running and it encounters a filter block, if no data matches the filter conditions specified, the playbook will proceed to the end block. The end block signifies the completion of the playbook's execution path that was contingent on the filter conditions being met. If the filter conditions are not met, and there are no alternative paths specified, the playbook recognizes this as the logical conclusion of that particular execution flow.

• Question 13:

  Which of the following will show all artifacts that have the term results in a filePath CEF value?

  A. .../rest/artifact?_filter_cef_filePath_icontain=''results''

  B. ...rest/artifacts/filePath=''%results%''

  C. .../result/artifacts/cef/filePath= '%results%''

  D. .../result/artifact?_query_cef_filepath_icontains=''results

  Correct Answer: A

  The correct answer is A because the _filter parameter is used to filter the results based on a field value, and the icontain operator is used to perform a case- insensitive substring match. The filePath field is part of the Common Event Format (CEF) standard, and the cef_ prefix is used to access CEF fields in the REST API. The answer B is incorrect because it uses the wrong syntax for the REST API. The answer C is incorrect because it uses the wrong endpoint (result instead of artifact) and the wrong syntax for the REST API. The answer D is incorrect because it uses the wrong syntax for the REST API and the wrong spelling for the icontains operator. Reference: Splunk SOAR REST API Guide, page 18. To query and display all artifacts that contain the term "results" in a filePath CEF (Common Event Format) value, using the REST API endpoint with a filter parameter is effective. The filter _filter_cef_filePath_icontain="results" is applied to search within the artifact data for filePath fields that contain the term "results", disregarding case sensitivity. This method allows users to precisely locate and work with artifacts that meet specific criteria, aiding in the investigation and analysis processes within Splunk SOAR.

• Question 14:

  Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

  A. Any of the integrated Splunk/Phantom Apps

  B. Splunk App for Phantom Reporting.

  C. Splunk App for Phantom.

  D. Phantom App for Splunk.

  Correct Answer: C

  The Splunk App for Phantom is designed to facilitate the integration between Splunk Enterprise Security and Splunk SOAR (Phantom), enabling the seamless forwarding of notable events from Splunk to Phantom. This app allows users to leverage the analytical and data processing capabilities of Splunk ES and utilize Phantom for automated orchestration and response. The app typically includes mechanisms for specifying which notable events to send to Phantom, formatting the data appropriately, and ensuring secure communication between the two platforms. This integration is crucial for organizations looking to combine the strengths of Splunk's SIEM capabilities with Phantom's automation and orchestration features to enhance their security operations.

• Question 15:

  Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

  A. On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.

  B. On the command line enter: sudo phenv python ibackup.pyc --backup --backup-type full, then sudo phenv python ibackup.pyc --setup.

  C. Within the UI: Select from the main menu Administration > System Health > Backup.

  D. Within the UI: Select from the main menu Administration > Product Settings > Backup.

  Correct Answer: B

  The correct answer is B because the steps required to complete a full backup of a Splunk Phantom deployment are to first run the --backup --backup-type full command and then run the --setup command. The --backup command creates a backup file in the /opt/phantom/backup directory. The --backup-type full option specifies that the backup file includes all the data and configuration files of the Phantom server. The --setup command creates a configuration file that contains the encryption key and other information needed to restore the backup file. See Splunk SOAR Certified Automation Developer Track for more details. Performing a full backup of a Splunk Phantom deployment involves using the command- line interface, primarily because Phantom's architecture and data management processes are designed to be managed at the server level for comprehensive backup and recovery. The correct sequence involves initiating a full backup first using the --backup --backup- type full option to ensure all configurations, data, and necessary components are included in the backup. Following the completion of the backup, the --setup option might be used to configure or verify the backup settings, although typically, the setup would precede backup operations in practical scenarios. This process ensures that all aspects of the Phantom deployment are preserved, including configurations, playbooks, cases, and other data, which is crucial for disaster recovery and system migration.

• Question 16:

  Is it possible to import external Python libraries such as the time module?

  A. No.

  B. No, but this can be changed by setting the proper permissions.

  C. Yes, in the global block.

  D. Yes. from a drop-down menu.

  Correct Answer: C

  In Splunk SOAR, it is possible to import external Python libraries, such as the time module, within the scope of a playbook's global code block. The global block allows users to define custom Python code, including imports of standard Python libraries that are included in the Phantom platform's Python environment. This capability enables the extension of playbooks' functionality with additional Python logic, making playbooks more powerful and versatile in their operations.

• Question 17:

  Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?

  A. Notes

  B. Actions

  C. Service level agreement (SLA) expiration

  D. Playbooks

  Correct Answer: D

  The severity of a container in Splunk Phantom can be set manually or automatically during the ingestion process. In addition to these methods, playbooks can also change the severity of a container. Playbooks are automated workflows that define a series of actions based on certain triggers and conditions. Within a playbook, actions can be defined to adjust the severity level of a container depending on the analysis of the event data, the outcome of actions taken, or other contextual factors. This dynamic adjustment allows for a more accurate and responsive incident prioritization as new information becomes available during the investigation process.

• Question 18:

  Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

  A. Make sure the Execute Playbook capability is removed from all roles except admin.

  B. Place restricted playbooks in a second source repository that has restricted access.

  C. Add a filter block to all restricted playbooks that filters for runRole = "Admin".

  D. Add a tag with restricted access to the restricted playbooks.

  Correct Answer: A

  To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute Playbook' capability must be managed appropriately. This is done by ensuring that this capability is removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk SOAR allows for granular permissions, which means you can configure which roles have the ability to execute playbooks, and by restricting this capability, you can control which users are able to initiate playbook runs.

• Question 19:

  When working with complex data paths, which operator is used to access a sub-element inside another element?

  A. !(pipe)

  B. *(asterisk)

  C. :(colon)

  D. .(dot)

  Correct Answer: D

  When working with complex data paths in Splunk SOAR, particularly within playbooks, the dot (.) operator is used to access sub-elements within a larger data structure. This operator allows for the navigation through nested data, such as dictionaries or objects within JSON responses, enabling playbook actions and decision blocks to reference specific pieces of data within the artifacts or action results. This capability is crucial for extracting and manipulating relevant information from complex data sets during incident analysis and response automation.

• Question 20:

  After a successful POST to a Phantom REST endpoint to create a new object what result is returned?

  A. The new object ID.

  B. The new object name.

  C. The full CEF name.

  D. The PostGres UUID.

  Correct Answer: A

  The correct answer is A because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is the new object ID. The object ID is a unique identifier for each object in Phantom, such as a container, an artifact, an action, or a playbook. The object ID can be used to retrieve, update, or delete the object using the Phantom REST API. The answer B is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the new object name, which is a human-readable name for the object. The object name can be used to search for the object using the Phantom web interface. The answer C is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the full CEF name, which is a standard format for event data. The full CEF name can be used to access the CEF fields of an artifact using the Phantom REST API. The answer D is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the PostGres UUID, which is a unique identifier for each row in a PostGres database. The PostGres UUID is not exposed to the Phantom REST API. Reference: Splunk SOAR REST API Guide, page 17. When a POST request is made to a Phantom REST endpoint to create a new object, such as an event, artifact, or container, the typical response includes the ID of the newly created object. This ID is a unique identifier that can be used to reference the object within the system for future operations, such as updating, querying, or deleting the object. The response does not usually include the full name or other specific details of the object, as the ID is the most important piece of information needed immediately after creation for reference purposes.