2.3 Define the Strategy for Data Sources, Integrations, and Feeds, and Select the Appropriate Onboarding Methods SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team is evaluating threat intelligence feeds. They have limited storage and processing capacity. Which feed characteristic should they prioritize to avoid overwhelming their platform?

   • AHigh volume of indicators
   • BLow false-positive rate
   • CBroad coverage of all threat types
   • DFrequent updates
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is onboarding 500 remote endpoints that connect to the internet via various ISPs. The security operations team needs to ingest endpoint telemetry into their security platform. The endpoints are not always online, and the team wants to minimize the load on the endpoint devices. Which onboarding method should they choose?

   • AInstall an agent on each endpoint that pushes data to the platform via HTTPS
   • BConfigure each endpoint to send syslog to a central collector
   • CUse a cloud API to pull data directly from each endpoint
   • DDeploy a network tap on each endpoint's local network
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to feed data from their on-premises Active Directory, cloud SaaS applications, and network firewalls into their security platform. Which data sources should they prioritize for onboarding first?

   • ANetwork firewalls, as they provide the most security-relevant data
   • BThe sources that provide the highest risk visibility and align with the organization's security strategy
   • CCloud SaaS applications, as they are the newest
   • DAll of them, as they are all critical
   Reveal Solution Discussion Select an answer first
5. 29foundation · medium

   Which of the following is a key component of a data lifecycle management policy?

   • AData visualization
   • BData backup
   • CData archiving
   • DData encryption
   Reveal Solution Discussion Select an answer first
6. 30foundation · medium

   What is the primary purpose of defining data retention policies in a security operations platform?

   • ATo encrypt data at rest
   • BTo make data available indefinitely
   • CTo increase storage costs
   • DTo comply with regulatory and operational requirements
   Reveal Solution Discussion Select an answer first