EMT Practice Test

1. Question Content...

---

Question1: Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

Question2: A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?

Question3: Which of the following are examples of things commonly done with the Phantom REST APP

Question4: A user selects the New option under Sources on the menu. What will be displayed?

Question5: What is the default embedded search engine used by Phantom?

Question6: Within the 12A2 design methodology, which of the following most accurately describes the last step?

Question7: Playbooks typically handle which types of data?

Question8: Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

Question9: A new project requires event data from SOAR to be sent to an external system via REST. All events with the label notable that are in new status should be sent. Which of the following REST Django expressions will select the correct events?

Question10: What do assets provide for app functionality?

Question11: An active playbook can be configured to operate on all containers that share which attribute?

Question12: Which of the following can be configured in the ROl Settings?

Question13: What values can be applied when creating Custom CEF field?

Question14: Which of the following will show all artifacts that have the term results in a filePath CEF value?

Question15: Without customizing container status within Phantom, what are the three types of status for a container?

Question16: What is the simplest way to pass data between playbooks?

Question17: How can more than one user perform tasks in a workbook?

Question18: What is the main purpose of using a customized workbook?

Question19: When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible?

Question20: How can a child playbook access the parent playbook's action results?

Question21: Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Question22: What metrics can be seen from the System Health Display? (select all that apply)

Question23: The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

Question24: Which of the following are tabs of an asset configuration?

Question25: What is the default log level for system health debug logs?

Question26: Which of the following can be done with the System Health Display?

Question27: Which of the following items cannot be modified once entered into SOAR?

Question28: How can parent and child playbooks pass information to each other?

Question29: Without customizing container status within SOAR, what are the three types of status for a container?

Question30: How can the debug log for a playbook execution be viewed?

Question31: How is it possible to evaluate user prompt results?

Question32: A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

Question33: Which app allows a user to run Splunk queries from within Phantom?

Question34: Where in SOAR can a user view the JSON data for a container?

Question35: Which Phantom API command is used to create a custom list?

Question36: In addition to full backups. Phantom supports what other backup type using backup?

Question37: Which of the following accurately describes the Files tab on the Investigate page?

Question38: Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

Question39: In this image, which container fields are searched for the text "Malware"?

Question40: A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

Question41: On a multi-tenant Phantom server, what is the default tenant's ID?

Question42: When working with complex data paths, which operator is used to access a sub-element inside another element?

Question43: A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

Question44: Which of the following describes the use of labels in Phantom?

Question45: When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list.
How is it possible to enter the unlisted artifact value?

Question46: Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

Question47: What is the primary objective of using the I2A2 playbook design methodology?