6.8 Describe Managing, Orchestrating, and Automating Security Information and Events with Splunk 350-701 Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A large enterprise is deploying Splunk Enterprise to collect security logs from multiple data centers. The deployment will use a distributed architecture with multiple indexers and search heads. The team needs to ensure that data is available for search even if one indexer fails. Which Splunk feature should be configured to meet this high-availability requirement?

   • AConfigure search head clustering to replicate search artifacts across multiple search heads.
   • BConfigure a single large indexer with a high-performance RAID array to store all data.
   • CUse universal forwarders to send data to multiple search heads, which will store the data locally.
   • DConfigure indexer clustering with replication factor 2 to maintain copies of data on multiple indexers.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In Splunk, what is the primary purpose of a sourcetype?

   • ATo identify the format and structure of incoming data so Splunk can parse it correctly
   • BTo specify the destination index for the data
   • CTo define the access control list for a data source
   • DTo determine which search head will process the data
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A SOC uses Splunk to detect a specific malware signature in endpoint logs. When the signature is detected, the team wants to automatically isolate the affected endpoint from the network and open an incident ticket. The endpoint isolation is performed by a third-party orchestration platform. Which Splunk feature should be used to integrate with the orchestration platform?

   • AConfigure a scheduled search that runs every 15 minutes and sends an email to the SOC team with the list of affected endpoints.
   • BCreate a dashboard panel that displays the affected endpoints and rely on the SOC analyst to manually initiate isolation.
   • CUse the Splunk REST API to create a saved search that outputs the affected endpoints to a CSV file for manual review.
   • DConfigure an alert with a webhook action that sends a JSON payload to the orchestration platform's API to trigger the isolation playbook.
   Reveal Solution Discussion Select an answer first