Describe the Value of Data Normalization in Order to Support Integration into Cybersecurity Defense Programs, Such as Security Monitoring and Threat Hunting, E.g. with CIM, CEF. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat hunter is looking for signs of data exfiltration by searching for large outbound transfers across firewall, proxy, and cloud storage logs. The data is normalized to CIM. Which field would the hunter use to filter for outbound traffic in a single search?

   • Adirection
   • Baction
   • Cbytes_out
   • Dsrc
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC has normalized their endpoint and network data to CIM. They now want to create a detection that identifies when a host communicates with a known-bad IP address. The detection should work across both data sources. What is the most efficient way to implement this detection?

   • ACreate a new data model for this specific detection to avoid using CIM.
   • BUse a lookup table to convert the 'dest' field to the 'src' field before running the search.
   • CWrite two separate searches, one for endpoint data and one for network data, and manually review the results.
   • DWrite a search that uses the CIM 'dest' field to match against the threat intelligence list, and run it against both data sources.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the Splunk Common Information Model (CIM)?

   • ATo encrypt security data in Splunk
   • BTo replace all other data models in Splunk
   • CTo provide a standard schema for normalizing security data
   • DTo provide a graphical interface for security analysts
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is a unified view of data important for threat hunting?

   • AIt ensures that all data is stored in a single database
   • BIt guarantees that all threats are found
   • CIt eliminates the need for threat hunting tools
   • DIt allows analysts to correlate activities across different systems without manual field mapping
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security engineer is configuring a legacy device to send CEF events to a SIEM. The device does not support the standard CEF header fields for source and destination IPs, but it can send custom extension fields. The SIEM expects the source IP in the CEF 'src' header field. What is the best approach to ensure the SIEM correctly identifies the source IP?

   • AConfigure the device to send the source IP in a custom extension field, and then have the SIEM parse that field and map it to the 'src' field during ingestion.
   • BSend the source IP in the 'suser' header field because it is the closest match.
   • CAsk the vendor to upgrade the device firmware to support the standard CEF header.
   • DDo not send the source IP because the SIEM can infer it from the network connection.
   Reveal Solution Discussion Select an answer first