Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

ag-Splunk Phantom > Phantom > Flashcards

Phantom Flashcards

1
Q

What is Splunk Phantom?

A

An intelligent nexus of connections to your security appliances and infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does Splunk Phantom do?

A

Ingests and anlyses data for security issues
Automates some or all incident response decisions
Takes action to contain or eliminate threats
provides tools to SOC personnel to investigate, respond and co-ordinate incident response activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

where can Phantom documentation be found?

A

Administration>? Documentation

docs.splunk.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What platforms can Phantom be installed on

A
  • Virtual Applaince
  • In the cloud as Amazon AMI
  • Red Hat or CentOS servers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False all install platforms support:

  • scaling up with clustered servers
  • externalizing compoinents
  • warm failover
A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

where do you download the ova?

A

my.phantom.us

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

true or false

.OVA and Amazon AMI run as as a root user account?

A

False
they run as non-root with user name phantom
Linux platform both root or Non Root installs are options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the methods to ingest data? Select all that apply.

a) manually
b) ingest over email
c) timer app
d) script-based ingestion over REST

A

d) script-based ingestion over RES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the automated methods for getting data into Phantom? Select all that apply.

a) manually
b) push from a source
c) use a TA
d) All of the above

A

push from a source
use a TA
Poll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the primary components for the Phantom system configuration?

a) playbooks, reports, cases, queues
b) apps, playbooks, assets, data sources, actions, owners
c) mission control, visual playbook editor, assets apps, actions
d) decided, ingestd, watchdogd, actiond, postgres, nginx, uwsgi

A

apps, playbooks, assets, data sources, actions, owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What’s your primary source for documentation on the Phantom platform?

a) Call a Splunk sales engineer
b) www.phantom.us
c) Phantom-Community Slack
d) VM/Platform

A

VM/Platform

docs.splunk.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The Phantom initial setup assigns a password to which two accounts?

a) phantom | admin
b) root | admin
c) phantom | sudo
d) user | root

A

user | root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Phantom provides the following mediums for the platform. Select all that apply.

a) OVA
b) AMI
c) RPMs
d) AWS

A

OVA

RPMs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Enable email notifications from the Phantom platform by ________.

a) configuring an SMTP asset
b) navigating to Administration, and select the SMTP source
c) configuring an SMTP in administration under Email settings
d) configuring an action to send an email via Python

A

configuring an SMTP asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or false: The Analyst queue is where you can reference all the artifacts for a container.

a) True
b) False

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In Mission Control, how do you get Ralph to help you?

a) Create a note and call Ralph
b) Send an email to Ralph
c) Use a mention to @ralph
d) Tag Ralph using Facebook

A

Use a mention to @ralph

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or false: You can only use SSH for git source code repositories.

a) True
b) False

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where can you create custom fields?

a) Product settings > Tags
b) Product settings > Environment
c) Product settings > Event settings
d) Company settings > Global settings

A

Product settings > Event settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or false: SLA settings use high, medium, and low severity levels for tracking response.

a) True
b) False

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In Python, a properly coded dictionary statement is __________.

a) [‘sourceAddresss’, ‘192.168.1.1’]
b) (‘sourceAddresss’, ‘192.168.1.1’)
c) sourceAddress(192.168.1.1)
d) {“sourceAddress” : “192.168.1.1”}

A

{“sourceAddress” : “192.168.1.1”}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where can you configure proxy settings?

a) Product settings > Apps
b) In the Application configuration
c) Administration > Product settings > Environment
d) Global settings

A

Administration > Product settings > Environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which statement is the correct use of IN for a Decision block?

a) sourceAddress IN ‘192.168.1.1’
b) artifact:*.cef.sourceAddress IN custom_black_list
c) action: Ralph_is IN the_house
d) None of the above

A

artifact:*.cef.sourceAddress IN custom_black_list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

True or false: Assets performing on poll can only be assigned to one tenant.

a) True
b) False

24
Q

What type of custom fields can you create?

a) Text boxes and multiple-select lists
b) Multiple-line text boxes
c) Select lists and text boxes
d) Radio buttons, select lists, and text boxes

A

Select lists and text boxes

25
True or false: Restrict access to sources using labels. a) True b) False
True
26
What are the three types of user accounts? a) Generic, REST, Administrator b) Local, Automation, Authentication method c) SAML, User, OpenID d) OpenID, CyberArk, Due
Local, Automation, Authentication method
27
True or false: You can use Google authenticator with multi-factor authentication. a) True b) False
False
28
True or false: You can restrict access to an action using asset configuration. a) True b) False
True
29
Phantom uses multiple daemons. Select all that apply. a) decided b) splunkd c) watchdogd d) actiond
decided watchdogd actiond
30
What does the daemon workflowd do? a) Ingests alarms and notifies containers b) Receives notifications from ingestd and processes playbooks c) Interfaces with external resources to gather and format response data d) Provides user notifications and holds any system delay processing
Provides user notifications and holds any system delay processing
31
Which daemon or process normalizes data and puts in the proper format? a) actiond b) ingestd c) REST d) applications
ingestd
32
Playbooks run based on the ______. a) ID b) list name c) tag d) label
label
33
What does the OODA acronym stand for? a) Observe Open Drive Arrange b) Orient Observe Delight Assess c) Observe Orient Decide Act d) Open Observe Deliver Apply
Observe Orient Decide Act
34
Automation strategies work best when they are __________. a) Not documented but well known and understood b) Easy to remember c) Well documented, procedural and intuitive d) Documented with decision points and procedures
Documented with decision points and procedures
35
Select the primary tools for helping you build playbooks? Select all that apply. a) Documentation b) Visual Playbook Editor c) Whiteboard d) Google
Documentation Visual Playbook Editor Whiteboard
36
Which block would you use to prepare data for an action? a) format b) filter c) decision d) action
format
37
Which block would you use to create selective data items? a) playbook b) decision c) filter d) format
filter
38
Which block would you use for customized code? a) format b) decision c) Playbook Code Editor d) API
API
39
Decision blocks use which python module to execute decisions? a) if then: b) phantom.case() c) if () elseif () d) phantom.conditions()
phantom.case()
40
Custom lists can be used to store data in Phantom for data comparison. Select all that apply. a) external EBL b) list of procedures for reuse c) various data sets d) All of the above
external EBL | various data sets
41
REST API allows automation developers to ___________. Select all that apply. a) interact with Phantom daemons b) customize Phantom APIs c) review platform data and system health d) customize data in the platform
review platform data and system health | customize data in the platform
42
what is required as part of browser support?
HTML 5 SVG graphics TLS Security
43
True or False | a Static IP address is not required for the installation of the OVA
False | it is required
44
what is the default user for the OVA CLI
phantom and password is password
45
what OS are supported
Red Hat Enterprise and CentOs
46
what are the default user name and password for the UI
admim/password
47
what is the community License
- 1 tenant - 5 new or open cases - 100 actions executed in each 24hr period
48
what is the standard licensing format
Seat based on the number of users configured in Phantom, come in sets of 5
49
What does the mobile app allow you to do
view events, respond to notifications, run playbooks
50
what is the default global number of current actions for assets?
10
51
true or False? | Users must have a user Account and role membership?
True
52
How can user accounts be created?
Manually in Phantom or automatically via directory integration (LDAP etc,)
53
Can role assignment be automated?
Yes | by mapping to directory service group membership
54
Is 2 factor authentication supported?
Yes via DUO
55
what is the default inactive timeout?
24hrs

ag-Splunk Phantom (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions