Define Technology Implementation Strategies to Provide Desired Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is deploying Splunk ES and wants to detect insider threats by correlating employee badge access, VPN logs, and HR data. The HR data is stored in a SQL database and is updated daily. Which approach should the architect take to make HR data available for correlation?

   • AUse a Universal Forwarder to monitor the SQL database directly.
   • BHave the HR team export the data to a CSV file and manually upload it to Splunk daily.
   • CUse the Splunk DB Connect app to periodically query the SQL database and index the results.
   • DUse a syslog input to receive HR data from the database server.
   Reveal Solution Discussion Select an answer first
2. 7application · hard

   A multinational company wants to deploy Splunk ES across three regions (US, EU, Asia) to support a global SOC. The SOC operates 24/7 and needs a single pane of glass for investigations. Data residency regulations require that EU citizen data stays in the EU. Which architecture should the architect recommend?

   • ADeploy a single indexer cluster in the US and have all forwarders send data there, using a search head in each region.
   • BDeploy separate Splunk deployments in each region, with no central search capability.
   • CUse a single indexer cluster in the EU and have all regions send data there.
   • DDeploy indexer clusters in each region, with a central search head cluster that uses federated search to query all three.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security architect is deploying Splunk ES for a company that uses a mix of Windows and Linux servers. The team wants to centralize log collection and reduce the number of agents installed on servers. Which strategy should the architect recommend?

   • AEnable SSH logging on Linux and Windows Event Log on Windows, and have Splunk connect to each server to pull logs.
   • BUse a third-party agent that supports both Windows and Linux and forwards to Splunk.
   • CInstall a Universal Forwarder on every server to collect logs directly.
   • DUse a centralized syslog server for Linux and Windows Event Forwarding (WEF) for Windows, then forward from these collectors to Splunk.
   Reveal Solution Discussion Select an answer first
5. 9application · hard

   A security architect is designing a Splunk ES deployment for a company that experiences occasional spikes in log volume (e.g., during a DDoS attack). The company wants to avoid paying for idle capacity during normal operations. Which deployment strategy best addresses this need?

   • AProvision enough indexers to handle the peak volume at all times.
   • BUse a fixed-size cluster and accept that some data will be dropped during spikes.
   • CDeploy a cluster sized for normal volume and use a message queue (e.g., Kafka) to buffer data during spikes, then process it as capacity allows.
   • DRoute all data to a cloud-based indexer during spikes and back to on-premises during normal operations.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services firm is deploying Splunk Enterprise Security (ES) and needs to ingest data from a legacy mainframe that only supports syslog over UDP. The security team requires guaranteed delivery of all security events to meet audit requirements. The mainframe team cannot install any additional software on the host. What implementation strategy should the architect recommend?

   • AHave the mainframe write events to a shared network drive that Splunk monitors via a file input.
   • BConfigure the mainframe to send syslog directly to the Splunk indexer on UDP 514 and rely on the indexer's acknowledgment mechanism.
   • CDeploy a lightweight syslog collector on a separate server that receives UDP syslog and forwards to Splunk over TCP with indexer acknowledgment enabled.
   • DUse Splunk Universal Forwarder on the mainframe to monitor the syslog file and forward directly to the indexer.
   Reveal Solution Discussion Select an answer first