A company uses a threat intelligence platform (TIP) that provides a list of malicious IP addresses. They want to enrich their firewall logs in Cribl with a field indicating if the source IP is malicious. What is the most effective way to do this?

Send all logs to the TIP for enrichment and then to the SIEM.

Use a Cribl Parser to extract the malicious IP field from the log.

Use a Cribl lookup table populated with the TIP's malicious IP list and add a field based on a match.

Configure the firewall to add the malicious IP field to its logs.

What is a common integration between a data pipeline and a threat intelligence platform?

The pipeline stores all threat intelligence feeds for long-term archival

The pipeline generates new threat intelligence from raw logs

The pipeline replaces the threat intelligence platform's aggregation capabilities

The pipeline enriches events with threat intelligence indicators before sending them to the SIEM

What is the purpose of data enrichment in a security data pipeline?

To add additional context to events, such as geolocation or threat intelligence

To remove sensitive data from events to comply with privacy regulations

To compress data to reduce storage costs

To change the format of data to match a destination's requirements

What is a key metric to monitor for data pipeline health?

The number of users accessing the pipeline

The number of destinations configured

The color of the pipeline dashboard

Palo Alto NetworksCertified Security Operations Architect

Domain 2Objective 1

2.1 Plan Data Pipeline Architecture Using Data Pipeline Tools (e.g., Cribl) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 3)

Part of the Platform and Data Architecture domain, which accounts for 49% of the SECURITY-OPERATIONS-ARCHITECT exam.

39questions here

8free pages

12concepts

49%of the exam

12 Concepts in This Objective

Data Pipeline Architecture Fundamentals
Cribl Overview and Capabilities
Data Sources and Destinations
Data Ingestion and Collection
Data Transformation and Normalization
Data Routing and Load Balancing
Data Filtering and Reduction
Data Pipeline Scalability and Performance
Data Pipeline Reliability and Fault Tolerance
Data Pipeline Security and Compliance
Integration with Security Operations Workflows
Monitoring and Troubleshooting Data Pipelines

Questions 11–15

11application · medium
A company uses a threat intelligence platform (TIP) that provides a list of malicious IP addresses. They want to enrich their firewall logs in Cribl with a field indicating if the source IP is malicious. What is the most effective way to do this?
Select an answer first
12foundation · easy
What is a common integration between a data pipeline and a threat intelligence platform?
Select an answer first
13foundation · easy
Which of the following is a common data source in a security data pipeline?
Select an answer first
14foundation · easy
What is the purpose of data enrichment in a security data pipeline?
Select an answer first
15foundation · easy
What is a key metric to monitor for data pipeline health?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.