Define Technology Implementation Strategies to Provide Desired Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security architect is deploying Splunk ES for a company that has a mix of sensitive data (PII) and non-sensitive operational logs. The company must restrict access to PII to a small team of analysts. The architect needs to ensure that the PII is not searchable by the general SOC team. Which strategy is most appropriate?

   • AIngest PII into a separate index and use role-based access control (RBAC) to restrict access to that index.
   • BStore PII in a separate Splunk deployment and have analysts log in to both systems.
   • CEncrypt the PII fields at rest and rely on encryption to prevent access.
   • DMask the PII fields at index time so all users see masked values.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A Splunk Cybersecurity Defense Architect is defining a technology implementation strategy for a new security operations center. The primary goal is to ensure that the chosen technologies directly support the required security capabilities. Which approach best aligns with this goal?

   • APrioritize technologies that are easiest to deploy and manage, regardless of the security capabilities they provide.
   • BImplement a comprehensive suite of security tools to cover all possible capabilities, even if some are not currently needed.
   • CSelect technologies based on the latest industry trends and vendor recommendations.
   • DDefine the desired security capabilities first, then map each capability to the technology that can deliver it.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is deploying Splunk ES and needs to ingest Windows security logs from 5,000 endpoints. The security team is concerned about the load on the domain controllers and wants to minimize the impact on production systems. Which ingestion strategy should the architect choose?

   • AInstall a Universal Forwarder on each endpoint and forward directly to the indexers.
   • BEnable Splunk's built-in Windows input on the domain controllers to collect from all endpoints.
   • CConfigure Windows Event Forwarding (WEF) to send events to a dedicated collector, then use a Universal Forwarder on the collector to send to Splunk.
   • DUse a syslog server to receive Windows events and forward to Splunk.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is deploying Splunk ES and wants to detect brute-force attacks on their VPN. The VPN logs are currently sent to a syslog server. The architect needs to ingest these logs into Splunk and create a correlation search. What is the first step in the implementation strategy?

   • ACreate the correlation search in ES before ingesting any data.
   • BConfigure the syslog server to send data directly to the Splunk indexer.
   • CInstall the Splunk Add-on for VPN on the syslog server.
   • DConfigure a Universal Forwarder on the syslog server to forward the VPN logs to Splunk.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying Splunk ES and wants to monitor user activity on their custom web application. The application logs access events to a file on each web server. The security team wants to correlate this with Active Directory (AD) login events. Which ingestion strategy should the architect use?

   • AInstall a Universal Forwarder on each web server to monitor the log files, and use the Splunk Add-on for Active Directory to ingest AD logs.
   • BExport AD logs to the web server and have the web server forward both to Splunk.
   • CHave the web application send logs directly to the AD domain controllers for aggregation.
   • DUse a single Universal Forwarder on a central server to collect logs from all web servers via network shares.
   Reveal Solution Discussion Select an answer first