Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Splunk Phantom > Phantom > Flashcards

Phantom Flashcards

1
Q

What is Splunk Phantom?

A

An intelligent nexus of connections to your security appliances and infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does Splunk Phantom do?

A

Ingests and anlyses data for security issues
Automates some or all incident response decisions
Takes action to contain or eliminate threats
provides tools to SOC personnel to investigate, respond and co-ordinate incident response activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

where can Phantom documentation be found?

A

Administration>? Documentation

docs.splunk.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What platforms can Phantom be installed on

A
  • Virtual Applaince
  • In the cloud as Amazon AMI
  • Red Hat or CentOS servers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or False all install platforms support:

  • scaling up with clustered servers
  • externalizing compoinents
  • warm failover
A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

where do you download the ova?

A

my.phantom.us

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

true or false

.OVA and Amazon AMI run as as a root user account?

A

False
they run as non-root with user name phantom
Linux platform both root or Non Root installs are options

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the methods to ingest data? Select all that apply.

a) manually
b) ingest over email
c) timer app
d) script-based ingestion over REST

A

d) script-based ingestion over RES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the automated methods for getting data into Phantom? Select all that apply.

a) manually
b) push from a source
c) use a TA
d) All of the above

A

push from a source
use a TA
Poll

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the primary components for the Phantom system configuration?

a) playbooks, reports, cases, queues
b) apps, playbooks, assets, data sources, actions, owners
c) mission control, visual playbook editor, assets apps, actions
d) decided, ingestd, watchdogd, actiond, postgres, nginx, uwsgi

A

apps, playbooks, assets, data sources, actions, owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What’s your primary source for documentation on the Phantom platform?

a) Call a Splunk sales engineer
b) www.phantom.us
c) Phantom-Community Slack
d) VM/Platform

A

VM/Platform

docs.splunk.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The Phantom initial setup assigns a password to which two accounts?

a) phantom | admin
b) root | admin
c) phantom | sudo
d) user | root

A

user | root

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Phantom provides the following mediums for the platform. Select all that apply.

a) OVA
b) AMI
c) RPMs
d) AWS

A

OVA

RPMs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Enable email notifications from the Phantom platform by ________.

a) configuring an SMTP asset
b) navigating to Administration, and select the SMTP source
c) configuring an SMTP in administration under Email settings
d) configuring an action to send an email via Python

A

configuring an SMTP asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or false: The Analyst queue is where you can reference all the artifacts for a container.

a) True
b) False

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In Mission Control, how do you get Ralph to help you?

a) Create a note and call Ralph
b) Send an email to Ralph
c) Use a mention to @ralph
d) Tag Ralph using Facebook

A

Use a mention to @ralph

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or false: You can only use SSH for git source code repositories.

a) True
b) False

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Where can you create custom fields?

a) Product settings > Tags
b) Product settings > Environment
c) Product settings > Event settings
d) Company settings > Global settings

A

Product settings > Event settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or false: SLA settings use high, medium, and low severity levels for tracking response.

a) True
b) False

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In Python, a properly coded dictionary statement is __________.

a) [‘sourceAddresss’, ‘192.168.1.1’]
b) (‘sourceAddresss’, ‘192.168.1.1’)
c) sourceAddress(192.168.1.1)
d) {“sourceAddress” : “192.168.1.1”}

A

{“sourceAddress” : “192.168.1.1”}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where can you configure proxy settings?

a) Product settings > Apps
b) In the Application configuration
c) Administration > Product settings > Environment
d) Global settings

A

Administration > Product settings > Environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which statement is the correct use of IN for a Decision block?

a) sourceAddress IN ‘192.168.1.1’
b) artifact:*.cef.sourceAddress IN custom_black_list
c) action: Ralph_is IN the_house
d) None of the above

A

artifact:*.cef.sourceAddress IN custom_black_list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

True or false: Assets performing on poll can only be assigned to one tenant.

a) True
b) False

A

True

24
Q

What type of custom fields can you create?

a) Text boxes and multiple-select lists
b) Multiple-line text boxes
c) Select lists and text boxes
d) Radio buttons, select lists, and text boxes

A

Select lists and text boxes

25
Q

True or false: Restrict access to sources using labels.

a) True
b) False

A

True

26
Q

What are the three types of user accounts?

a) Generic, REST, Administrator
b) Local, Automation, Authentication method
c) SAML, User, OpenID
d) OpenID, CyberArk, Due

A

Local, Automation, Authentication method

27
Q

True or false: You can use Google authenticator with multi-factor authentication.

a) True
b) False

A

False

28
Q

True or false: You can restrict access to an action using asset configuration.

a) True
b) False

A

True

29
Q

Phantom uses multiple daemons. Select all that apply.

a) decided
b) splunkd
c) watchdogd
d) actiond

A

decided
watchdogd
actiond

30
Q

What does the daemon workflowd do?

a) Ingests alarms and notifies containers
b) Receives notifications from ingestd and processes playbooks
c) Interfaces with external resources to gather and format response data
d) Provides user notifications and holds any system delay processing

A

Provides user notifications and holds any system delay processing

31
Q

Which daemon or process normalizes data and puts in the proper format?

a) actiond
b) ingestd
c) REST
d) applications

A

ingestd

32
Q

Playbooks run based on the ______.

a) ID
b) list name
c) tag
d) label

A

label

33
Q

What does the OODA acronym stand for?

a) Observe Open Drive Arrange
b) Orient Observe Delight Assess
c) Observe Orient Decide Act
d) Open Observe Deliver Apply

A

Observe Orient Decide Act

34
Q

Automation strategies work best when they are __________.

a) Not documented but well known and understood
b) Easy to remember
c) Well documented, procedural and intuitive
d) Documented with decision points and procedures

A

Documented with decision points and procedures

35
Q

Select the primary tools for helping you build playbooks? Select all that apply.

a) Documentation
b) Visual Playbook Editor
c) Whiteboard
d) Google

A

Documentation
Visual Playbook Editor
Whiteboard

36
Q

Which block would you use to prepare data for an action?

a) format
b) filter
c) decision
d) action

A

format

37
Q

Which block would you use to create selective data items?

a) playbook
b) decision
c) filter
d) format

A

filter

38
Q

Which block would you use for customized code?

a) format
b) decision
c) Playbook Code Editor
d) API

A

API

39
Q

Decision blocks use which python module to execute decisions?

a) if then:
b) phantom.case()
c) if () elseif ()
d) phantom.conditions()

A

phantom.case()

40
Q

Custom lists can be used to store data in Phantom for data comparison. Select all that apply.

a) external EBL
b) list of procedures for reuse
c) various data sets
d) All of the above

A

external EBL

various data sets

41
Q

REST API allows automation developers to ___________. Select all that apply.

a) interact with Phantom daemons
b) customize Phantom APIs
c) review platform data and system health
d) customize data in the platform

A

review platform data and system health

customize data in the platform

42
Q

what is required as part of browser support?

A

HTML 5
SVG graphics
TLS Security

43
Q

True or False

a Static IP address is not required for the installation of the OVA

A

False

it is required

44
Q

what is the default user for the OVA CLI

A

phantom and password is password

45
Q

what OS are supported

A

Red Hat Enterprise and CentOs

46
Q

what are the default user name and password for the UI

A

admim/password

47
Q

what is the community License

A
  • 1 tenant
  • 5 new or open cases
  • 100 actions executed in each 24hr period
48
Q

what is the standard licensing format

A

Seat based on the number of users configured in Phantom, come in sets of 5

49
Q

What does the mobile app allow you to do

A

view events, respond to notifications, run playbooks

50
Q

what is the default global number of current actions for assets?

A

10

51
Q

true or False?

Users must have a user Account and role membership?

A

True

52
Q

How can user accounts be created?

A

Manually in Phantom or automatically via directory integration (LDAP etc,)

53
Q

Can role assignment be automated?

A

Yes

by mapping to directory service group membership

54
Q

Is 2 factor authentication supported?

A

Yes via DUO

55
Q

what is the default inactive timeout?

A

24hrs

ag-Splunk Phantom (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions