Splunk SPLK-2003 Online Practice Questions and Exam Preparation

Splunk SPLK-2003 Online Questions & Answers

• Question 41:

  When analyzing events, a working on a case, significant items can be marked as evidence. Where can ail of a case's evidence items be viewed together?

  A. Workbook page Evidence tab.
  B. Evidence report.
  C. Investigation page Evidence tab.
  D. At the bottom of the Investigation page widget panel.
  C. Investigation page Evidence tab.

  ---

  Explanation/Reference:

  In Splunk SOAR, when working on a case and analyzing events, items marked as significant evidence are aggregated for review. These evidence items can be collectively viewed on the Investigation page under the Evidence tab. This centralized view allows analysts to easily access and review all marked evidence related to a case, facilitating a streamlined analysis process and ensuring that key information is readily available for investigation and decision-making.

• Question 42:

  How is a Django filter query performed?

  A. By adding parameters to the URL similar to the following: phantom/rest/container?_filter_tags_contains="sumo".
  B. phantom/rest/search/app/contains/"sumo"
  C. Browse to the Django Filter Query Editor in the Administration panel.
  D. Install the SOAR Django App first, then configure the search query in the App editor.
  A. By adding parameters to the URL similar to the following: phantom/rest/container?_filter_tags_contains="sumo".

  ---

  Explanation/Reference:

  Django filter queries in Splunk SOAR are performed by appending filter parameters directly to the REST API URL. This allows users to refine their search and retrieve specific data. For example, to filter containers by tags containing the word

  "sumo", the following URL structure would be used:

  https:///rest/container?_filter_tags_contains="sumo". This format enables users to construct dynamic queries that can filter results based on specified criteria within the Django framework used by Splunk SOAR.

  The correct way to perform a Django filter query in Splunk SOAR is to add parameters to the URL similar to the following: phantom/rest/container?_filter_tags_contains="sumo". This will return a list of containers that have the tag "sumo" in

  them. You can use various operators and fields to filter the results according to your needs. For more details, see Query for Data and Use filters in your Splunk SOAR (Cloud) playbook to specify a subset of artifacts before further processing.

  The other options are either incorrect or irrelevant for this question. For example:

  Phantom/rest/search/app/contains/"sumo" is not a valid URL for a Django filter query. It will return an error message saying "Invalid endpoint".

  There is no Django Filter Query Editor in the Administration panel of Splunk SOAR. You can use the REST API Tester to test your queries, but not to edit them.

  There is no SOAR Django App that needs to be installed or configured for performing Django filter queries. Splunk SOAR uses the Django framework internally, but you do not need to install or use any additional apps for this purpose.

• Question 43:

  Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

  A. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
  B. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
  C. SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)
  D. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)
  D. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

  ---

  Explanation/Reference:

  The correct answer is D because the default ports that must be configured on Splunk to allow connections from Phantom are SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088). SplunkWeb is the port used to access the Splunk web interface. SplunkD is the port used to communicate with the Splunk server. HTTP Collector is the port used to send data to Splunk using the HTTP Event Collector (HEC). These ports must be configured on Splunk and Phantom to enable the integration between the two products. See Splunk SOAR Documentation for more details. To allow connections from Splunk Phantom to Splunk, certain default ports need to be open and properly configured. The default ports include SplunkWeb (8000) for web access, SplunkD (8089) for Splunk's management port, and the HTTP Event Collector (HEC) on port 8088, which is used for ingesting data into Splunk. These ports are essential for the communication between Splunk Phantom and Splunk, facilitating data exchange, search capabilities, and the integration of various functionalities between the two platforms.

• Question 44:

  Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

  A. Non-Human
  B. Automation
  C. Automation Engineer
  D. Service Account
  A. Non-Human

  ---

  Explanation/Reference:

  In Splunk SOAR, the 'Non-Human' role is appropriate for accounts that are used exclusively to execute automated tasks. This role is designed for service accounts that interact with the SOAR platform programmatically rather than through a human user. It ensures that the account has the necessary permissions to perform automated actions while restricting access that would be unnecessary or inappropriate for a non-human entity.

• Question 45:

  Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?

  A. SAML3
  B. PIV/CAC
  C. Biometrics
  D. OpenID
  B. PIV/CAC

  ---

  Explanation/Reference:

  Splunk SOAR supports multiple user authentication methods to ensure secure access to the platform. Apart from LDAP (Lightweight Directory Access Protocol) and SAML2 (Security Assertion Markup Language 2.0), SOAR also supports PIV (Personal Identity Verification) and CAC (Common Access Card) as authentication methods. These are particularly used in government and military organizations for secure and authenticated access to systems, providing a high level of security through physical tokens or cards that contain encrypted user credentials.

• Question 46:

  How does a user determine which app actions are available?

  A. Add an action block to a playbook canvas area.
  B. Search the Apps category in the global search field.
  C. From the Apps menu, click the supported actions dropdown for each app.
  D. In the visual playbook editor, click Active and click the Available App Actions dropdown.
  A. Add an action block to a playbook canvas area.

  ---

  Explanation/Reference:

  A user can determine which app actions are available by adding an action block to a playbook canvas area. The action block will show a list of all the apps installed on the Phantom system and the actions supported by each app. The other options do not provide a comprehensive view of the app actions available. Reference, page 11. In Splunk Phantom, to determine which app actions are available, a user can add an action block to the playbook canvas area within the visual playbook editor. The action block will present a list of available apps and their associated actions that the user can choose from. This method provides a user-friendly way to browse and select from the various actions that can be incorporated into the automation workflows (playbooks). The visual playbook editor is a key component of Phantom, allowing users to design, edit, and manage playbooks via a graphical interface.

• Question 47:

  What is the main purpose of using a customized workbook?

  A. Workbooks automatically implement a customized processing of events using Python code.
  B. Workbooks guide user activity and coordination during event analysis and case operations.
  C. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
  D. Workbooks may not be customized; only default workbooks are permitted within Phantom.
  B. Workbooks guide user activity and coordination during event analysis and case operations.

  ---

  Explanation/Reference:

  The main purpose of using a customized workbook is to guide user activity and coordination during event analysis and case operations. Workbooks can be customized to include different phases, tasks, and instructions for the users. The other options are not valid purposes of using a customized workbook. See Workbooks for more information. Customized workbooks in Splunk SOAR are designed to guide users through the process of analyzing events and managing cases. They provide a structured framework for documenting investigations, tracking progress, and ensuring that all necessary steps are followed during incident response and case management. This helps in coordinating team efforts, maintaining consistency in response activities, and ensuring that all aspects of an incident are thoroughly investigated and resolved. Workbooks can be customized to fit the specific processes and procedures of an organization, making them a versatile tool for managing security operations.

• Question 48:

  Which of the following will show all artifacts that have the term results in a filePath CEF value?

  A. .../rest/artifact?_filter_cef_filePath_icontain=''results''
  B. ...rest/artifacts/filePath=''%results%''
  C. .../result/artifacts/cef/filePath= '%results%''
  D. .../result/artifact?_query_cef_filepath_icontains=''results
  A. .../rest/artifact?_filter_cef_filePath_icontain=''results''

  ---

  Explanation/Reference:

  The correct answer is A because the _filter parameter is used to filter the results based on a field value, and the icontain operator is used to perform a case- insensitive substring match. The filePath field is part of the Common Event Format (CEF) standard, and the cef_ prefix is used to access CEF fields in the REST API. The answer B is incorrect because it uses the wrong syntax for the REST API. The answer C is incorrect because it uses the wrong endpoint (result instead of artifact) and the wrong syntax for the REST API. The answer D is incorrect because it uses the wrong syntax for the REST API and the wrong spelling for the icontains operator. Reference: Splunk SOAR REST API Guide, page 18. To query and display all artifacts that contain the term "results" in a filePath CEF (Common Event Format) value, using the REST API endpoint with a filter parameter is effective. The filter _filter_cef_filePath_icontain="results" is applied to search within the artifact data for filePath fields that contain the term "results", disregarding case sensitivity. This method allows users to precisely locate and work with artifacts that meet specific criteria, aiding in the investigation and analysis processes within Splunk SOAR.

• Question 49:

  In a playbook, more than one Action block can be active at one time. What is this called?

  A. Serial Processing
  B. Parallel Processing
  C. Multithreaded Processing
  D. Juggle Processing
  B. Parallel Processing

  ---

  Explanation/Reference:

  In Splunk SOAR, when a playbook is designed such that more than one Action block is active at the same time, it is referred to as 'Parallel Processing'. This allows for multiple actions to be executed concurrently, which can significantly speed up the execution of a playbook as it does not have to wait for one action to complete before starting another. Parallel processing enables more efficient use of resources and time, particularly in complex playbooks that perform numerous actions.

• Question 50:

  A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

  A. Incorrect Join configuration on the second playbook.
  B. The first playbook is performing poorly.
  C. The steep option for the second playbook is not set to a long enough interval.
  D. Synchronous execution has not been configured.
  D. Synchronous execution has not been configured.

  ---

  Explanation/Reference:

  The correct answer is D because synchronous execution has not been configured. Synchronous execution is a feature that allows you to control the order of execution of playbook blocks. By default, Phantom executes playbook blocks asynchronously, meaning that it does not wait for one block to finish before starting the next one. This can cause problems when you have dependencies between blocks or when you call other playbooks. To enable synchronous execution, you need to use the sync action in the run playbook block and specify the name of the next block to run after the called playbook completes. See Splunk SOAR Documentation for more details. In Splunk SOAR, playbooks can be executed either synchronously or asynchronously. Synchronous execution ensures that a playbook waits for a called playbook to complete before proceeding to the next step. If the second playbook starts executing before the first one completes, it indicates that synchronous execution was not configured for the playbooks. Without synchronous execution, playbooks will execute independently of each other's completion status, leading to potential overlaps in execution. This behavior can be controlled by properly configuring the playbook execution settings to ensure that dependent playbooks complete their tasks in the desired order.