2.1 Plan Data Pipeline Architecture Using Data Pipeline Tools (e.g., Cribl) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team needs to demonstrate compliance with an audit requirement that all data transformations in the pipeline are logged. They are using Cribl Stream. What should they enable to meet this requirement?

   • ACribl's audit logging feature.
   • BThe SIEM's audit log.
   • CA new route to send all transformed data to a separate log file.
   • DA JavaScript function that logs each transformation to a file.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A Cribl Stream deployment is sending data to a data lake. The team is concerned about data loss if the Cribl Stream node fails. They have a single node deployment. What is the most important architectural change to ensure high availability and prevent data loss?

   • AAdd more worker processes to the single node.
   • BIncrease the disk size of the Cribl Stream node.
   • CConfigure the data lake to pull data from Cribl.
   • DDeploy Cribl Stream in a high-availability (HA) pair with shared state.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A financial institution is required to encrypt all log data in transit and at rest. They are using Cribl Stream to collect data from various sources and send it to a data lake. What is the correct way to meet this requirement?

   • AUse TLS for all Cribl inputs and outputs, and enable encryption on the data lake storage.
   • BEnable encryption on the data lake and rely on the internal network for security.
   • COnly use TLS for the connection between Cribl and the data lake.
   • DUse a VPN for all data transfers and disable TLS.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of data reduction in a security data pipeline?

   • ATo encrypt data to protect it from unauthorized access
   • BTo decrease the volume of data sent to destinations while retaining key security information
   • CTo increase the speed of data transmission by compressing all data
   • DTo ensure all data is stored in its original form for compliance
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A global company needs to collect data from sources in different geographic regions. They have a central Cribl Stream deployment. Due to data residency requirements, data from the EU must not leave the EU. What is the best architecture to meet this requirement?

   • ARoute all data to the central Cribl Stream and then filter it based on region.
   • BHave EU sources send data directly to the SIEM, bypassing Cribl.
   • CDeploy a separate Cribl Stream instance in the EU to collect and process EU data locally.
   • DUse a VPN to encrypt data from the EU to the central Cribl Stream.
   Reveal Solution Discussion Select an answer first