SPLK-2003 無料問題集「Splunk Phantom Certified Admin」

（A）Differential

（B）Snapshot

（C）Partial

（D）Incremental

（A）phantom.create_artifact ()

（B）phantom.new_artifact ()

（C）phantom. update ()

（D）phantom.add_artifact ()

（A）Evidence report.

（B）At the bottom of the Investigation page widget panel.

（C）Investigation page Evidence tab.

（D）Workbook page Evidence tab.

（A）Asset Name, Asset IP, Asset URL, Asset Nickname

（B）Tags, Asset Name, Asset Date, Asset Order

（C）Asset Info, Asset Settings, Approval Settings, Access Control

（D）App Name, App Order, App Expiry, App Version

（A）The container owner can assign any authorized user to any task in a workbook.

（B）Add the required users to the authorized list for the container.

（C）Any user in a role with write access to the case's workbook can be assigned to tasks.

（D）Any user with a role that has Perform Task enabled can execute tasks for workbooks.

（A）By restarting the playbook daemon.

（B）On the System Health page.

（C）In Administration > Server Settings.

（D）By restarting the automation service.

（A）When modifying downstream data hi one or more paths in the playbook.

（B）When processing different data in parallel.

（C）When evaluating complex, multi-value results or artifacts.

（D）When selecting one (or zero) possible paths in the playbook.

（A）Decision and action blocks.

（B）Filter and decision blocks.

（C）Prompt and decision blocks.

（D）Filter and prompt blocks.

（A）To define a set of users who have access to a sensitive tag.

（B）To define a set of users who have access to a special label.

（C）To define a set of users who have access to a restricted app.

（D）To define a set of users who have access to an event's reports.

（A）Rename the event_id field from the notable event to splunkNotableEventld.

（B）Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.

（C）Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.

（D）Include the notable event's event_id field and set the artifacts label to aplunk notable event id.