Splunk Phantom Certified Admin - SPLK-2003 Exam Questions [2026]

QUESTION NO: 1
Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

A. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088) B. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000) C. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000) D. SplunkWeb (8469), SplunkD (8702), HTTP Collector (8864)

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
What is the default embedded search engine used by SOAR?

A. Embedded Splunk search engine. B. Embedded Django search engine. C. Embedded SOAR search engine. D. Embedded Elastic search engine.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
Which of the following can be edited or deleted in the Investigation page?

A. Approval records B. Comments C. Action results D. Artifact values

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Which of the following is accurate?

A. Phantom.debug() outputs to the VPE debugger display. B. Users can output debug info using the print() or print "" syntax. C. System.Out.Prinln() outputs to the VPE debugger display. D. Phantom.debug() is the same as phantom.error() except it prints in red text.

Correct Answer: A

QUESTION NO: 5
Which of the following actions will store a compressed, secure version of an email attachment with suspected malware for future analysis?

A. Add a link to the file in a new artifact. B. Use the Files tab on the Investigation page to upload the attachment. C. Use the Upload action of the Secure Store app to store the file in the database. D. Copy/paste the attachment into a note.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Which Phantom VPE Nock S used to add information to custom lists?

A. Action blocks B. API blocks C. Filter blocks D. Decision blocks

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
To limit the impact of custom code on the VPE, where should the custom code be placed?

A. A separate code repository. B. A separate container. C. A custom function block. D. A custom container or a separate KV store.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
What metrics can be seen from the System Health Display? (select all that apply)

A. Playbook Usage B. Load Average C. Disk Usage D. Memory Usage

Correct Answer: B,C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
Why is it good playbook design to create smaller and more focused playbooks? (select all that apply)

A. To avoid duplication of code across multiple playbooks. B. Reduce large complex playbooks which become difficult to maintain. C. Encourages code reuse in a more compartmentalized form. D. Reduces amount of playbook data stored in each repo.

Correct Answer: A,B,C