2.3 Define the Strategy for Data Sources, Integrations, and Feeds, and Select the Appropriate Onboarding Methods SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · medium

   Which of the following is a key consideration when defining a strategy for integrating data sources into a security operations platform?

   • AData source reliability
   • BData source location
   • CData source color
   • DData source vendor
   Reveal Solution Discussion Select an answer first
2. 22foundation · medium

   Which of the following is a key criterion for selecting a data feed for a security operations platform?

   • AThe feed is available in multiple formats
   • BData quality and accuracy
   • CThe feed is free
   • DThe feed is from a well-known vendor
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company must retain security logs for at least one year to meet regulatory requirements, but their security platform's primary storage is expensive. They want to keep the platform responsive for active investigations. What should they do?

   • AReduce log verbosity to lower storage usage
   • BStore all logs in the platform's primary storage for the full year
   • CDelete logs after 90 days to save storage costs
   • DArchive logs older than 90 days to a lower-cost storage tier and retain them for a year
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   When defining an integration strategy for data sources, which factor is most important to consider for handling large volumes of data?

   • AMarketing strategy
   • BColor scheme
   • CUser interface design
   • DScalability
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company ingests logs from multiple sources with different formats. They want to ensure that all logs are enriched with user identity information. However, some sources do not provide user identity. What is the best approach?

   • AEnrich logs from sources that provide user identity, and leave others as-is
   • BUse a mapping table to correlate IP addresses to user identities for all sources
   • CNormalize all logs to a common format and enrich with available data, including a placeholder for missing user identity
   • DDiscard logs that do not have user identity
   Reveal Solution Discussion Select an answer first