Splunk SPLK-2003 試験概要:
Splunk SPLK-2003 認定試験の出題範囲:
| トピック | 出題範囲 |
|---|
| トピック 1 | - Visual Playbook Editor: Sub-topics are about using the editor, executing actions from playbooks, and testing new playbooks. Cybersecurity professionals who attempt the Splunk SOAR Certified Automation Developer exam must learn how to create and modify automated workflows by using SOAR’s visual interface.
|
| トピック 2 | - System Maintenance: The Splunk SPLK-2003 exam assesses candidates on their ability to monitor and maintain SOAR's performance. Understanding reports, system health, and logs is crucial for cybersecurity professionals to pass the test.
|
| トピック 3 | - User Management: User Management in the SPLK-2003 exam tests candidates on adding users, configuring authentication, and creating roles. SOC analysts and administrators who attempt the exam must manage user access and permissions.
|
| トピック 4 | - Logic, Filters, and User Interaction: It focuses on usage of decision blocks, join options, filter blocks, and user interaction features. SOC analysts must get knowledge about interactive playbooks as well.
|
| トピック 5 | - Apps, Assets, and Playbooks: Cybersecurity professionals should understand assets, configuring apps, and data ingestion for the SPLK-2003 exam. Proficiency in these areas enhances SOAR's automation and security tool integration.
|
| トピック 6 | - Using REST: Splunk Enterprise Security administrators and SOC analysts cover sub-topics related to accessing SOAR data from other systems, SOAR REST API capabilities, and Django queries.
|
| トピック 7 | - Analyst Queue: The Analyst Queue topic focuses on search features and filter creation. SOC analysts who attempt the Splunk SOAR Certified Automation Developer exam must prepare to manage and prioritize security events effectively within the SOAR platform.
|
| トピック 8 | - Formatted Output and Data Access: Formatted Output and Data Access topic teaches structuring data, understanding action results, and composing datapaths. This knowledge enhances automation by manipulating and accessing data effectively.
|
| トピック 9 | - Custom Coding: The primary focus of this topic is on writing custom SOAR code, using the global block, and custom function blocks.
|
参照:https://www.splunk.com/en_us/training/certification-track/splunk-phantom-certified-admin.html