3.5 Configure Splunk to Ingest Cloud Logging and Monitoring Data from Other Security Solutions 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team needs to ingest AWS CloudTrail logs into Splunk. They have an existing Splunk Enterprise deployment on-premises and want to use the AWS add-on. The team has created an IAM role with the required permissions and configured the add-on to use that role. However, no data appears in Splunk. Which configuration step is most likely missing?

   • AConfigure the add-on to use the correct AWS region for the S3 bucket that stores CloudTrail logs.
   • BEnable the CloudTrail log file integrity validation feature in AWS.
   • CCreate an S3 bucket policy that grants public read access to the CloudTrail logs.
   • DInstall the Splunk Add-on for AWS on the Splunk search head, not the indexer.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company ingests Google Cloud Logging data into Splunk using the Google Cloud add-on. The logs contain a field called 'severity' with values like 'INFO', 'WARNING', and 'ERROR'. The security team wants to map these to Splunk's native severity levels (info, warn, error) for consistent dashboards. What is the most efficient way to achieve this?

   • AUse a lookup table to map the Google Cloud severity values to Splunk severity levels.
   • BUse the 'replace' command in a search to change the values.
   • CConfigure the add-on to rename the field to 'splunk_severity' and use automatic mapping.
   • DUse a regex in transforms.conf to extract the severity and then use eval to convert it.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   Which Splunk feature is commonly used to receive logs from third-party security solutions that support HTTP-based event delivery?

   • AMonitor input
   • BHTTP Event Collector (HEC)
   • CTCP input
   • DScripted input
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   Which Azure service provides a unified platform for collecting and analyzing logs and metrics from Azure resources?

   • AAzure Monitor
   • BAzure Log Analytics
   • CAzure Security Center
   • DAzure Sentinel
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses Azure Monitor to collect activity logs from their Azure subscription. They want to forward these logs to Splunk for centralized security analysis. They have set up an Azure event hub and configured the diagnostic settings to stream the activity logs to the event hub. In Splunk, they have installed the Splunk Add-on for Microsoft Cloud Services and configured the input for Azure Event Hubs. However, no logs are appearing in Splunk. What is the most likely cause?

   • AThe Azure activity logs are not enabled for the subscription.
   • BThe Splunk add-on requires the Azure Log Analytics workspace to be configured first.
   • CThe event hub must be in the same region as the Splunk deployment.
   • DThe event hub namespace and event hub name in the Splunk add-on configuration do not match the Azure resources.
   Reveal Solution Discussion Select an answer first