Define Technology Implementation Strategies to Provide Desired Capabilities. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is deploying Splunk ES and wants to monitor cloud infrastructure (AWS, Azure, GCP) alongside on-premises systems. The security team wants a unified view of all security events. Which implementation strategy should the architect recommend?

   • AUse separate Splunk deployments for cloud and on-premises, and manually correlate events.
   • BExport all on-premises logs to a single cloud provider and use that provider's native SIEM.
   • CUse Splunk Add-ons for each cloud provider to ingest data into the same Splunk deployment as on-premises data.
   • DUse a third-party SIEM to aggregate all logs and forward them to Splunk.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large enterprise is deploying Splunk ES and has a requirement to retain all security logs for 5 years for legal reasons. However, the security team only needs to search the last 6 months for active investigations. The data volume is massive, and the budget is limited. The architect must balance retention, searchability, and cost. Which strategy is the most cost-effective while meeting all requirements?

   • AUse a 6-month hot/cold retention policy, then archive the data to a low-cost storage tier (e.g., S3 or Glacier) for the remaining 4.5 years.
   • BDelete data older than 6 months and rely on the legal team's records for compliance.
   • CStore all data in hot storage for 5 years to ensure immediate searchability.
   • DStore all data in cold storage for 5 years and only search it when needed.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security architect is implementing Splunk ES for a large enterprise. The SOC team wants to create custom correlation searches, but they are not familiar with SPL. The architect needs to enable the team to build detections quickly without writing code. Which feature should the architect enable?

   • ASplunk Enterprise Security's Correlation Search Builder.
   • BThe `search` command in the Splunk web interface.
   • CSplunk's Data Model acceleration.
   • DSplunk's REST API for creating searches programmatically.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying Splunk ES and wants to ingest data from a variety of sources, including custom applications that output JSON. The architect needs to ensure that the data is parsed correctly and available for correlation searches. What is the most efficient way to handle this?

   • AUse the Heavy Forwarder to parse the JSON before sending to the indexer.
   • BUse a Universal Forwarder to send the JSON data and configure a props.conf/transforms.conf on the indexer to parse it.
   • CWrite a custom script on each application server to convert JSON to a flat text format before sending.
   • DIngest the JSON as raw text and rely on the search-time extraction.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A global bank is deploying Splunk ES and must comply with GDPR for EU customer data. The bank's SOC is centralized in the US. The architect must ensure that EU data is not transferred outside the EU while still allowing US analysts to investigate incidents. Which strategy satisfies both requirements?

   • ADeploy an indexer cluster in the EU and a search head in the US that uses federated search to query the EU cluster.
   • BDeploy a full Splunk stack (indexers and search heads) in the EU and have US analysts VPN into the EU environment.
   • CDeploy a single indexer cluster in the US and ensure all EU data is pseudonymized before ingestion.
   • DUse a single US-based deployment and rely on the EU's adequacy decision for the US.
   Reveal Solution Discussion Select an answer first