2.3 Define the Strategy for Data Sources, Integrations, and Feeds, and Select the Appropriate Onboarding Methods SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard · select all that apply

   A company must comply with data retention regulations that require logs to be kept for 2 years. They also need to ensure that sensitive data is protected. Which practices should they implement? (Select all that apply.)

   • AEncrypt archived logs
   • BDelete logs after 1 year
   • CArchive logs to a secure, lower-cost storage after a certain period
   • DImplement access controls on archived logs
   Check answers Discussion Select an answer first
2. 17expert · hard

   A security operations team is selecting threat intelligence feeds. They have a limited budget and need to cover both external threats and insider threats. They are considering two feeds: one focused on external malware and one focused on user behavior analytics. Which approach is most effective?

   • ASubscribe to both feeds, even if it exceeds the budget
   • BChoose the external malware feed, as it is more traditional
   • CChoose the user behavior analytics feed, as it is more advanced
   • DEvaluate the feeds for relevance and quality, and choose the one that best aligns with the organization's risk profile
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's security platform stores logs for 30 days, but their compliance team requires 90 days of retention for certain data. The platform's storage is limited. What is the best approach to meet the requirement?

   • AArchive the required data to a separate storage system after 30 days
   • BExtend the retention period for all data to 90 days
   • CIncrease the platform's storage capacity
   • DReduce the retention period to 15 days to save space
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company ingests logs from multiple sources: firewalls, endpoints, and cloud services. Each source uses different log formats and field names. The security team wants to ensure that alerts are consistent and searchable across all data. What should they implement?

   • AA manual mapping of fields for each source
   • BA data normalization and enrichment pipeline
   • CA separate storage for each data source
   • DA single syslog collector for all sources
   Reveal Solution Discussion Select an answer first
6. 20foundation · medium

   Which onboarding method is most appropriate for a data source that does not support agent installation and requires real-time event streaming?

   • AAgent-based
   • BManual upload
   • CSyslog
   • DBatch processing
   Reveal Solution Discussion Select an answer first