SPLK-2003

SPLK-2003 practice questions, page 3 of 3, with answer review and explanations.

Question 11

Which of the following items cannot be modified once entered into SOAR?

  1. A comment.
  2. A note.
  3. A container.
  4. An artifact.

Question 12

After a playbook has run, where are the results stored?

  1. Container
  2. Log file
  3. Case
  4. Splunk Index

Question 13

Which of the following accurately describes the Files tab on the Investigate page?

  1. Files tab items cannot be added to investigations. Instead, add them to action blocks.
  2. SOAR memory requirements remain static, regardless of Files tab usage.
  3. Files tab items and artifacts are the only data sources that can populate active cases.
  4. A user can upload the output from a detonate action to the Files tab for further investigation.

Question 14

Which of the following can be done with the System Health Display?

  1. Partially rewind processes, which is useful for debugging.
  2. Create a temporary, edited version of a process and test the results.
  3. Reset DECIDED to reset playbook environments back to at-start conditions.
  4. View a single column of status for SOAR processes. For metrics, click Details.

Question 15

What values can be applied when creating Custom CEF fields?

  1. Name, Data Type
  2. Name
  3. Name, Value
  4. Name, Data Type, Severity