Question 1

What are indicators?

Options :

A : Action result items that determine the flow of execution in a playbook.

B : Action results that may appear in multiple containers.

C : Artifact values that can appear in multiple containers.

D : Artifact values with special security significance.

Answer: C

Question 2

Is it possible to import external Python libraries such as the time module?

Options :

A : No

B : No, but this can be changed by setting the proper permissions.

C : Yes, in the global block.

D : Yes. from a drop-down menu.

Answer: C

Question 3

Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment'

Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

Options :

A :

On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.

B :

On the command line enter: sudo phenv python ibackup.pyc --backup —backup-type full, then sudo phenv python ibackup.pyc --setup.

C : Within the UI: Select from the main menu Administration > System Health > Backup.

D : Within the UI: Select from the main menu Administration > Product Settings > Backup.

Answer: B

Question 4

Which Phantom API command is used to create a custom list?

Options :

A : phantom.add_list()

B : phantom.create_list()

C : phantom.include_list()

D : phantom.new_list()

Answer: B

Question 5

After a playbook has run, where are the results stored?

Options :

A : Splunk Index

B : Case

C : Container

D : Log file

Answer: C