Splunk SPLK-2003 Online Practice Questions and Exam Preparation

Splunk SPLK-2003 Online Questions & Answers

• Question 71:

  What is enabled if the Logging option for a playbook's settings is enabled?

  A. More detailed logging information Is available m the Investigation page.
  B. All modifications to the playbook will be written to the audit log.
  C. More detailed information is available in the debug window.
  D. The playbook will write detailed execution information into the spawn.log.
  C. More detailed information is available in the debug window.

  ---

  Explanation/Reference:

  Enabling the Logging option for a playbook's settings in Splunk SOAR enhances the level of detail provided in the debug window when the playbook is executed. This feature is particularly useful for development and troubleshooting purposes, as it allows playbook authors and analysts to see more granular information about how each action within the playbook operates, including inputs, outputs, and any errors or warnings. This detailed logging aids in identifying issues, understanding the playbook's flow, and optimizing performance.

• Question 72:

  How can a child playbook access the parent playbook's action results?

  A. Child playbooks can access parent playbook data while the parent Is still running.
  B. By setting scope to ALL when starting the child.
  C. When configuring the playbook block in the parent, add the desired results in the Scope parameter.
  D. The parent can create an artifact with the data needed by the did.
  C. When configuring the playbook block in the parent, add the desired results in the Scope parameter.

  ---

  Explanation/Reference:

  In Splunk Phantom, child playbooks can access the action results of a parent playbook through the use of the Scope parameter. When a parent playbook calls a child playbook, it can pass certain data along by setting the Scope parameter to include the desired action results. This parameter is configured within the playbook block that initiates the child playbook. By specifying the appropriate scope, the parent playbook effectively determines what data the child playbook will have access to, allowing for a more modular and organized flow of information between playbooks.

• Question 73:

  Which of the following can be configured in the ROI Settings?

  A. Number of full time employees (FTEs).
  B. Time lost.
  C. Analyst hours per month.
  D. Annual analyst salary.
  C. Analyst hours per month.

  ---

  Explanation/Reference:

  ROI Settings dashboard allows you to configure the parameters used to estimate the data displayed in the Automation ROI Summary dashboard. One of the settings that can be configured is the FTE Gained, which is the number of full time employees (FTEs) that are freed up by automation. To calculate this value, Splunk SOAR divides the number of actions run by automation by the number of expected actions an analyst would take, based on minutes per action and analyst hours per day. Therefore, option A is the correct answer, as it is one of the settings that can be configured in the ROI Settings dashboard. Option B is incorrect, because time lost is not a setting that can be configured in the ROI Settings dashboard, but a metric that is calculated by Splunk SOAR based on the difference between the analyst minutes per action and the actual minutes per action. Option C is incorrect, because analyst hours per month is not a setting that can be configured in the ROI Settings dashboard, but a value that is derived from the analyst hours per day setting. Option D is incorrect, because annual analyst salary is a setting that can be configured in the ROI Settings dashboard, but not the one that is asked in the question.

  1: Configure the ROI Settings dashboard in Administer Splunk SOAR (On-premises) ROI (Return on Investment) Settings within Splunk SOAR are used to estimate the efficiency and financial impact of the SOAR platform. One of the configurable parameters in these settings is the 'Analyst hours per month'. This parameter helps in calculating the time saved through automation, which in turn can be translated into cost savings and efficiency gains. It reflects the direct contribution of the SOAR platform to operational productivity.

• Question 74:

  In this image, which container fields are searched for the text "Malware"?

  

  A. Event Name and Artifact Names.
  B. Event Name, Notes, Comments.
  C. Event Name or ID.
  C. Event Name or ID.

  ---

  Explanation/Reference:

  In the image provided, the search functionality within Splunk's Phantom Security Orchestration, Automation, and Response (SOAR) platform is shown. When you enter a search term like "Malware" in the search bar, Splunk Phantom will typically search through the container fields that are most relevant to identifying and categorizing events. Containers in Phantom are used to group related events, indicators, cases, and tasks. They contain various fields that can be searched through, such as the Event Name or ID, which are primary identifiers for a container. This search does not extend to fields such as Notes or Comments, which are ancillary text entries linked to an event or container. Artifact Names are part of the container's data structure but are not the primary search target in this context unless specifically configured to be included in the search scope.

• Question 75:

  Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

  A. Make sure the Execute Playbook capability is removed from all roles except admin.
  B. Place restricted playbooks in a second source repository that has restricted access.
  C. Add a filter block to all restricted playbooks that filters for runRole = "Admin".
  D. Add a tag with restricted access to the restricted playbooks.
  A. Make sure the Execute Playbook capability is removed from all roles except admin.

  ---

  Explanation/Reference:

  To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute Playbook' capability must be managed appropriately. This is done by ensuring that this capability is removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk SOAR allows for granular permissions, which means you can configure which roles have the ability to execute playbooks, and by restricting this capability, you can control which users are able to initiate playbook runs.

• Question 76:

  Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

  A. Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.
  B. Add a tag with restricted access to the restricted playbooks.
  C. Make sure the Execute Playbook capability is removed from al roles except admin.
  D. Place restricted playbooks in a second source repository that has restricted access.
  C. Make sure the Execute Playbook capability is removed from al roles except admin.

  ---

  Explanation/Reference:

  The correct answer is C because the best way to restrict the execution of playbooks to members of the admin role is to make sure the Execute Playbook capability is removed from all roles except admin. The Execute Playbook capability is a permission that allows a user to run any playbook on any container. By default, all roles have this capability, but it can be removed or added in the Phantom UI by going to Administration > User Management > Roles. Removing this capability from all roles except admin will ensure that only admin users can execute playbooks. See Splunk SOAR Documentation for more details. To ensure that only members of the admin role can execute specific playbooks on the Phantom server, the most effective approach is to manage role-based access controls (RBAC) directly. By configuring the system to remove the "Execute Playbook" capability from all roles except for the admin role, you can enforce this rule. This method leverages Phantom's built-in RBAC mechanisms to restrict playbook execution privileges. It is a straightforward and secure way to ensure that only users with the necessary administrative privileges can initiate the execution of sensitive or critical playbooks, thus maintaining operational security and control.

• Question 77:

  When writing a custom function that uses regex to extract the domain name from a URL, a user wants to create a new artifact for the extracted domain. Which of the following Python API calls will create a new artifact?

  A. phantom.new_artifact ()
  B. phantom. update ()
  C. phantom.create_artifact ()
  D. phantom.add_artifact ()
  C. phantom.create_artifact ()

  ---

  Explanation/Reference:

  In the Splunk SOAR platform, when writing a custom function in Python to handle data such as extracting a domain name from a URL, you can create a new artifact using the Python API call phantom.create_artifact(). This function allows you to specify the details of the new artifact, such as the type, CEF (Common Event Format) data, container it belongs to, and other relevant information necessary to create an artifact within the system.

• Question 78:

  Which Phantom API command is used to create a custom list?

  A. phantom.add_list()
  B. phantom.create_list()
  C. phantom.include_list()
  D. phantom.new_list()
  B. phantom.create_list()

  ---

  Explanation/Reference:

  The Phantom API command to create a custom list is phantom.create_list(). This command takes a list name and an optional description as parameters and returns a list ID if successful. The other commands are not valid Phantom API commands. phantom.add_list() is a Python function that can be used in custom code blocks to add data to an existing list. To create a custom list in Splunk Phantom, the appropriate API command used is phantom.create_list(). This function allows for the creation of a new list that can be used to store data such as IP addresses, file hashes, or any other information that you want to track or reference across multiple playbooks or within different parts of the Phantom platform. The custom list is a flexible data structure that can be leveraged for various use cases within Phantom, including data enrichment, persistent storage of information, and cross-playbook data sharing.

• Question 79:

  What values can be applied when creating Custom CEF field?

  A. Name
  B. Name, Data Type
  C. Name, Value
  D. Name, Data Type, Severity
  B. Name, Data Type

  ---

  Explanation/Reference:

  Custom CEF fields can be created with a name and a data type. The name must be unique and the data type must be one of the following: string, int, float, bool, or list. The severity is not a valid option for custom CEF fields. See Creating custom CEF fields for more details. When creating Custom Common Event Format (CEF) fields in Splunk SOAR (formerly Phantom), the essential values you need to specify are the "Name" of the field and the "Data Type." The "Name" is the identifier for the field, while the "Data Type" specifies the kind of data the field will hold, such as string, integer, IP address, etc. This combination allows for the structured and accurate representation of data within SOAR, ensuring that custom fields are compatible with the platform's data processing and analysis mechanisms.

• Question 80:

  The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

  A. The existing content indexes on the SOAR server need to be re-indexed to migrate them to Splunk.
  B. The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.
  C. The remote Splunk search head is currently offline.
  D. Content that existed before configuring external search must be backed up on SOAR and restored on the Splunk search head.
  B. The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.

  ---

  Explanation/Reference:

  If, after configuring an external Splunk search head for search in SOAR, the search results do not include content that was previously returned, one possible issue could be that the user account configured on the SOAR side does not have the required permissions (such as the 'phantomsearch' capability) enabled on the Splunk side. This capability is necessary for the SOAR server to execute searches and retrieve results from the Splunk search head.