EMT Practice Test

1. Question Content...

---

Question1: During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

Question2: Without customizing container status within Phantom, what are the three types of status for a container?

Question3: What is the main purpose of using a customized workbook?

Question4: Within the 12A2 design methodology, which of the following most accurately describes the last step?

Question5: An active playbook can be configured to operate on all containers that share which attribute?

Question6: A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.

Question7: Which of the following is the complete list of the types of backups that are supported by Phantom?

Question8: After a successful POST to a Phantom REST endpoint to create a new object what result is returned?

Question9: What is enabled if the Logging option for a playbook's settings is enabled?

Question10: What values can be applied when creating Custom CEF field?

Question11: On a multi-tenant Phantom server, what is the default tenant's ID?

Question12: How can a child playbook access the parent playbook's action results?

Question13: A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

Question14: Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

Question15: Which of the following will show all artifacts that have the term results in a filePath CEF value?

Question16: Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?

Question17: Which of the following describes the use of labels m Phantom?

Question18: How can the debug log for a playbook execution be viewed?

Question19: A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

Question20: Which of the following is a best practice for use of the global block?

Question21: How is it possible to evaluate user prompt results?