EMT Practice Test

1. Question Content...

---

Question1: Where can the Splunk App for SOAR Export be downloaded from?

Question2: How can a child playbook access the parent playbook's action results?

Question3: Why does SOAR use wildcards within artifact data paths?

Question4: Which two playbook blocks can discern which path in the playbook to take next?

Question5: What are the differences between cases and events?

Question6: A user wants to get the playbook results for a single artifact. Which steps will accomplish the?

Question7: Which Phantom API command is used to create a custom list?

Question8: How does a user determine which app actions are available?

Question9: When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

Question10: What users are included in a new installation of SOAR?

Question11: Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?

Question12: Without customizing container status within SOAR, what are the three types of status for a container?

Question13: What metrics can be seen from the System Health Display? (select all that apply)

Question14: On a multi-tenant Phantom server, what is the default tenant's ID?

Question15: Which of the following will show all artifacts that have the term results in a filePath CEF value?

Question16: A user selects the New option under Sources on the menu. What will be displayed?

Question17: What are the components of the I2A2 design methodology?

Question18: Which of the following can be done with the System Health Display?

Question19: Which of the following queries would return all artifacts that contain a SHA1 file hash?

Question20: After enabling multi-tenancy, which of the Mowing is the first configuration step?

Question21: Where in SOAR can a user view the JSON data for a container?

Question22: When working with complex data paths, which operator is used to access a sub-element inside another element?

Question23: Within the 12A2 design methodology, which of the following most accurately describes the last step?

Question24: Which of the following can be configured in the ROl Settings?

Question25: When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible?

Question26: Which of the following can be edited or deleted in the Investigation page?

Question27: A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?

Question28: What values can be applied when creating Custom CEF field?

Question29: Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

Question30: During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

Question31: Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

Question32: What are indicators?

Question33: An active playbook can be configured to operate on all containers that share which attribute?

Question34: Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

Question35: Which of the following are examples of things commonly done with the Phantom REST APP

Question36: Which app allows a user to run Splunk queries from within Phantom?

Question37: How can the debug log for a playbook execution be viewed?

Question38: A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.

Question39: Without customizing container status within Phantom, what are the three types of status for a container?

Question40: When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list.
How is it possible to enter the unlisted artifact value?

Question41: Which of the following is a best practice for use of the global block?

Question42: To limit the impact of custom code on the VPE, where should the custom code be placed?