2.3 Define the Strategy for Data Sources, Integrations, and Feeds, and Select the Appropriate Onboarding Methods SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 7)

Questions 31–33

1. 31foundation · medium

   What is the primary purpose of data normalization in a security operations platform?

   • ATo convert data into a consistent format
   • BTo increase data volume
   • CTo encrypt data
   • DTo reduce storage costs
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company must retain security logs for 5 years due to industry regulations. Their security platform's primary storage is expensive, and they want to keep the platform's performance high. They also need to be able to access archived logs for investigations. What is the best approach?

   • ACompress logs to reduce storage size, but keep them in the primary platform
   • BStore all logs in the primary platform for 5 years
   • CDelete logs after 1 year to save costs
   • DArchive logs to a lower-cost storage after a short period, with a retrieval process
   Reveal Solution Discussion Select an answer first
3. 33expert · hard · select all that apply

   A security operations team is selecting threat intelligence feeds. They need to ensure the feeds are relevant to their organization's industry and have high-quality indicators. Which of the following should they consider? (Select all that apply.)

   • AThe feed's cost
   • BThe feed's update frequency
   • CThe feed's false-positive rate
   • DThe feed's coverage of industry-specific threats
   Check answers Discussion Select an answer first