2.1 Plan Data Pipeline Architecture Using Data Pipeline Tools (e.g., Cribl) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   A SOC team is ingesting raw firewall logs that contain the source IP, destination IP, and port. The SIEM requires a field called 'direction' (inbound/outbound) to be populated for all events. The team wants to use Cribl to add this field automatically. What is the best way to achieve this?

   • AUse a Cribl Parser to extract the 'direction' field from the raw log message.
   • BAsk the firewall vendor to add the 'direction' field to their logs.
   • CConfigure the SIEM to calculate the 'direction' field on ingestion.
   • DUse a Cribl JavaScript function to evaluate the source and destination IPs and set the 'direction' field.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company sends all their security logs to a single SIEM. They want to use Cribl to route authentication logs to a separate identity analytics platform while sending all other logs to the SIEM. What is the most efficient way to configure this in Cribl?

   • AConfigure the sources to send authentication logs directly to the identity platform.
   • BCreate two separate pipelines, one for authentication logs and one for all other logs.
   • CUse a single pipeline with two routes: one with a filter for authentication logs to the identity platform, and a default route for all other logs to the SIEM.
   • DSend all logs to the SIEM and have the SIEM forward authentication logs to the identity platform.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is Cribl's primary role in a security data architecture?

   • AAn endpoint detection and response (EDR) agent that collects and analyzes endpoint data
   • BA threat intelligence platform that aggregates and correlates threat feeds
   • CA SIEM platform that provides real-time security monitoring and alerting
   • DA data pipeline tool that routes, transforms, and enriches data before it reaches destinations like SIEMs and data lakes
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team is designing a new data pipeline to collect logs from cloud services (AWS CloudTrail, Azure AD) and on-premises firewalls. They want to centralize this data for analysis in a SIEM. What is the primary purpose of placing a data pipeline tool like Cribl between the sources and the SIEM?

   • ATo provide a single point of ingestion, transformation, and routing for all data sources.
   • BTo create a direct connection between each source and the SIEM.
   • CTo increase the storage capacity of the SIEM.
   • DTo replace the SIEM as the primary storage and analysis platform.
   Reveal Solution Discussion Select an answer first