- All Exams Instant Download
What is the cause of this behavior?
A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?A . Incorrect Join configuration on the second playbook.B . The first playbook is performing...
What are indicators?
What are indicators?A . Action result items that determine the flow of execution in a playbook.B . Action results that may appear in multiple containers.C . Artifact values that can appear in multiple containers.D . Artifact values with special security significance.View AnswerAnswer: C
An active playbook can be configured to operate on all containers that share which attribute?
An active playbook can be configured to operate on all containers that share which attribute?A . ArtifactB . LabelC . TagD . SeverityView AnswerAnswer: B
On a multi-tenant Phantom server, what is the default tenant's ID?
On a multi-tenant Phantom server, what is the default tenant's ID?A . 0B . DefaultC . 1D . *View AnswerAnswer: D
Which of the following applies to filter blocks?
Which of the following applies to filter blocks?A . Can select which blocks have access to container data.B . Can select assets by tenant, approver, or app.C . Can be used to select data for use by other blocks.D . Can select containers by seventy or status.View AnswerAnswer: A
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.A . On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.B...
During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?
During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?A . The container has artifacts not parameters.B . The playbook is using an incorrect container.C . The playbook debugger's scope is set to new.D...
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?A . superuser, administratorB . phantomcreate. phantomeditC . phantomsearch, phantomdeleteD . admin,userView AnswerAnswer: A
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches.
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possibleA . Enter the two queries in the asset as comma separated values.B . Configure the second query...
What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?
What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?A . Include the notable event's event_id field and set the artifacts label to aplunk notable event id.B . Rename the event_id field from the notable event to...
