New SPLK-2003 Dumps Questions [2022] For Completing Splunk SOAR Certified Automation Developer Exam

1. Configuring Phantom search to use an external Splunk server provides which of the following benefits?

2. Within the 12A2 design methodology, which of the following most accurately describes the last step?

3. Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

4. An active playbook can be configured to operate on all containers that share which attribute?

5. Which of the following applies to filter blocks?

6. A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes.

What is the cause of this behavior?

7. A customer wants to design a modular and reusable set of playbooks that all communicate with each other.

Which of the following is a best practice for data sharing across playbooks?

8. Which of the following are examples of things commonly done with the Phantom REST APP

9. Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

10. Without customizing container status within Phantom, what are the three types of status for a container?

11. Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

12. Phantom supports multiple user authentication methods such as LDAP and SAML2.

What other user authentication method is supported?

13. During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

14. What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

15. After enabling multi-tenancy, which of the Mowing is the first configuration step?

16. When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches.

How is this possible

17. On a multi-tenant Phantom server, what is the default tenant's ID?

18. What are indicators?

19. Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

20. Some of the playbooks on the Phantom server should only be executed by members of the admin role.

How can this rule be applied?