SPLK-2003 無料問題集「Splunk Phantom Certified Admin」

（A）Create a filter for status=new and owner=pat.

（B）Create a filter for status=new or owner=pat.

（C）Create a filter for label-new and owner-pat.

（D）Create a filter for status-open and owner-pat.

（A）When configuring the playbook block in the parent, add the desired results in the Scope parameter.

（B）Child playbooks can access parent playbook data while the parent Is still running.

（C）The parent can create an artifact with the data needed by the did.

（D）By setting scope to ALL when starting the child.

（A）Biometrics

（B）SAML3

（C）PIV/CAC

（D）OpenID

（A）Cases: incidents with a known violation and a plan for correction.
Events: occurrences in the system that may require a response.

（B）Cases: contain a collection of containers.
Events: contain potential threats.

（C）Cases: only include high-level incident artifacts.
Events: only include low-level incident artifacts.

（D）Case: potential threats.
Events: identified as a specific kind of problem and need a structured approach.

（A）Install the SOAR Django App first, then configure the search query in the App editor.

（B）Browse to the Django Filter Query Editor in the Administration panel.

（C）By adding parameters to the URL similar to the following: phantom/rest/container?
_filter_tags_contains="sumo".

（D）phantom/rest/search/app/contains/"sumo"

（A）Parallel Processing

（B）Juggle Processing

（C）Multithreaded Processing

（D）Serial Processing

（A）Differential

（B）Snapshot

（C）Partial

（D）Incremental

（A）Tag

（B）Label

（C）Artifact

（D）Severity

（A）Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.

（B）Click Expand Scope m the debug window.

（C）On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.

（D）In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.

（A）superuser, administrator

（B）phantomcreate. phantomedit

（C）phantomsearch, phantomdelete

（D）admin,user