A security operations center (SOC) is ingesting verbose DNS logs. The SIEM license is based on data volume, and the team has determined that only DNS queries from internal clients are needed for threat detection. They want to reduce the data volume sent to the SIEM without losing critical information. What should the Cribl pipeline do?

Use a Cribl pack to sample 50% of all DNS logs.

Drop all DNS logs and rely on the firewall logs for DNS information.

Use a filter to only send DNS logs where the source IP is in the internal network range.

Send all DNS logs to the SIEM but reduce the retention period.

Which of the following is a method Cribl can use to ingest data from a source?

Using a SOAR playbook to generate data for Cribl

Using a SIEM to pull data from Cribl

Using a forwarder to collect and send data to Cribl

Using a data lake to store data before sending to Cribl

What is a key security requirement for a data pipeline handling sensitive security data?

Encrypting data in transit and at rest

Storing all data in a single location for simplicity

Allowing all users to access the pipeline for transparency

Disabling audit logging to reduce storage costs

Which of the following is a key feature of Cribl as a data pipeline tool?

The ability to replace the need for a data lake by storing all data internally

The ability to route data to multiple destinations based on content or source

The ability to perform deep packet inspection and block malicious traffic

The ability to run vulnerability scans on endpoints and servers

Which of the following is a common destination for data in a security data pipeline?

A cloud access security broker (CASB)

Palo Alto NetworksCertified Security Operations Architect

Domain 2Objective 1

2.1 Plan Data Pipeline Architecture Using Data Pipeline Tools (e.g., Cribl) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 1)

Part of the Platform and Data Architecture domain, which accounts for 49% of the SECURITY-OPERATIONS-ARCHITECT exam.

39questions here

8free pages

12concepts

49%of the exam

12 Concepts in This Objective

Data Pipeline Architecture Fundamentals
Cribl Overview and Capabilities
Data Sources and Destinations
Data Ingestion and Collection
Data Transformation and Normalization
Data Routing and Load Balancing
Data Filtering and Reduction
Data Pipeline Scalability and Performance
Data Pipeline Reliability and Fault Tolerance
Data Pipeline Security and Compliance
Integration with Security Operations Workflows
Monitoring and Troubleshooting Data Pipelines

Questions 1–5

1application · medium
A security operations center (SOC) is ingesting verbose DNS logs. The SIEM license is based on data volume, and the team has determined that only DNS queries from internal clients are needed for threat detection. They want to reduce the data volume sent to the SIEM without losing critical information. What should the Cribl pipeline do?
Select an answer first
2foundation · easy
Which of the following is a method Cribl can use to ingest data from a source?
Select an answer first
3foundation · easy
What is a key security requirement for a data pipeline handling sensitive security data?
Select an answer first
4foundation · easy
Which of the following is a key feature of Cribl as a data pipeline tool?
Select an answer first
5foundation · easy
Which of the following is a common destination for data in a security data pipeline?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.