Question No : 1
1.Configuring Phantom search to use an external Splunk server provides which of the following benefits?

• A.The ability to run more complex reports on Phantom activities.
• B.The ability to ingest Splunk notable events into Phantom.
• C.The ability to automate Splunk searches within Phantom.
• D.The ability to display results as Splunk dashboards within Phantom.

Show Answers

Answer:

Question No : 2
What is enabled if the Logging option for a playbook's settings is enabled?

• A.More detailed logging information Is available m the Investigation page.
• B.All modifications to the playbook will be written to the audit log.
• C.More detailed information is available in the debug window.
• D.The playbook will write detailed execution information into the spawn.log.

Show Answers

Answer:

Question No : 3
What is the default embedded search engine used by Phantom?

• A.Embedded Splunk search engine.
• B.Embedded Phantom search engine.
• C.Embedded Elastic search engine.
• D.Embedded Django search engine.

Show Answers

Answer:

Question No : 4
Which of the following supported approaches enables Phantom to run on a Windows server?

• A.Install the Phantom RPM in a GNU Cygwin implementation.
• B.Run the Phantom OVA as a cloud instance.
• C.Install the Phantom RPM file in Windows Subsystem for Linux (WSL).
• D.Run the Phantom OVA as a virtual machine.

Show Answers

Answer:

Question No : 5
Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

• A.Any of the integrated Splunk/Phantom Apps
• B.Splunk App for Phantom Reporting.
• C.Splunk App for Phantom.
• D.Phantom App for Splunk.

Show Answers

Answer:

Question No : 6
What do assets provide for app functionality?

• A.Assets provide location, credentials, and other parameters needed to run actions.
• B.Assets provide hostnames, passwords, and other artifacts needed to run actions.
• C.Assets provide Python code, REST API, and other capabilities needed to run actions.
• D.Assets provide firewall, network, and data sources needed to run actions.

Show Answers

Answer:

Question No : 7
In addition to full backups. Phantom supports what other backup type using backup?

• A.Snapshot
• B.Incremental
• C.Partial
• D.Differential

Show Answers

Answer:

Question No : 8
How can a child playbook access the parent playbook's action results?

• A.Child playbooks can access parent playbook data while the parent Is still running.
• B.By setting scope to ALL when starting the child.
• C.When configuring the playbook block in the parent, add the desired results in the Scope parameter.
• D.The parent can create an artifact with the data needed by the did.

Show Answers

Answer:

Question No : 9
Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

• A.SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
• B.SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
• C.SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)
• D.SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

Show Answers

Answer:

Question No : 10
How can the debug log for a playbook execution be viewed?

• A.On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.
• B.Click Expand Scope m the debug window.
• C.In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.
• D.Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.

Show Answers

Answer: