2.1 Plan Data Pipeline Architecture Using Data Pipeline Tools (e.g., Cribl) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses a SOAR platform that requires alerts in a specific JSON schema. The SIEM sends raw alerts to Cribl. The team wants to use Cribl to convert these alerts into the SOAR's required format before sending them. What is the correct approach?

   • AUse a Cribl JavaScript function to map the SIEM alert fields to the SOAR schema.
   • BConfigure the SOAR to accept the SIEM's native alert format.
   • CSend the raw alerts to a data lake and have the SOAR query the data lake.
   • DUse Cribl's 'Alert Normalization' pack.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Cribl Stream deployment sends data to a SIEM. The SIEM occasionally has maintenance windows and returns HTTP 503 errors. The security team must ensure no data is lost during these windows. The pipeline is currently configured to send data directly to the SIEM. What is the most reliable configuration to prevent data loss?

   • AIncrease the worker processes for the SIEM destination.
   • BRoute data to a second SIEM instance during maintenance.
   • CEnable the SIEM destination's 'Retry on Error' setting with a high retry count.
   • DAdd a persistent queue to the SIEM destination and configure a dead-letter queue for failed events.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is performance important in a security data pipeline?

   • ATo ensure data is delivered to analysis tools with minimal latency for timely threat detection
   • BTo increase the storage capacity of destinations
   • CTo eliminate the need for data filtering
   • DTo reduce the need for data transformation
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a common troubleshooting step when data is not appearing at a destination?

   • ACheck the pipeline's logs for errors or dropped events
   • BReboot the destination server
   • CIncrease the number of sources
   • DDisable all filters
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization ingests proxy logs that use varied URL formats and a SIEM that requires a normalized 'domain' field extracted from the URL. The team wants to ensure the SIEM can correlate this data with other sources. What is the most appropriate Cribl action?

   • AUse a Cribl Parser to extract the domain from the URL and write it to a new field.
   • BEnable Cribl's built-in 'URL Normalization' pack.
   • CRoute all proxy logs to a data lake for later analysis.
   • DConfigure the SIEM to parse the URL field on ingestion.
   Reveal Solution Discussion Select an answer first