Free Splunk SPLK-2003 Exam Dumps Questions & Answers

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

• A.  Install a second Splunk app and configure the query in the second app.
• B.  Configure the second query in the Phantom app for Splunk.
• C.  Enter the two queries in the asset as comma separated values.
• D.  Configure a second Splunk asset with the second query.

Which of the following can be configured in the ROI Settings?

• A.  Analyst hours per month.
• B.  Time lost.
• C.  Annual analyst salary.
• D.  Number of full time employees (FTEs).

On a multi-tenant Phantom server, what is the default tenant's ID?

• A.  0
• B.  Default
• C.  1
• D.  *

If two or more conditions apply to data in a filter block, which path is followed in the playbook?

• A.  All matching paths will be followed, but the first path to reach the end block will terminate the playbook.
• B.  Only the first matching condition will activate its path.
• C.  All paths with matching conditions are followed in parallel.
• D.  Only the last matching condition will activate its path.

What users are included in a new installation of SOAR?

• A.  Only the admin user is included by default.
• B.  The admin and automation users are included by default.
• C.  No users are included by default.
• D.  The admin, power, and user users are included by default.