Describe the Value of Data Normalization in Order to Support Integration into Cybersecurity Defense Programs, Such as Security Monitoring and Threat Hunting, E.g. with CIM, CEF. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a key consideration when mapping raw data to CEF?

   • AEnsure that extension field values are properly escaped and formatted
   • BEnsure that all fields are placed in the header
   • CEnsure that all events use the same device vendor
   • DEnsure that the raw data is converted to XML
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat hunter is investigating a potential lateral movement campaign. The hunter needs to search across endpoint, firewall, and authentication logs to find all connections from a suspicious host. The data is currently stored in its native formats. What is the primary challenge the hunter will face?

   • AThe field names for the source and destination IPs may differ across sources, requiring multiple search terms or a normalization step.
   • BThe data will be automatically normalized by Splunk, so no additional effort is needed.
   • CThe data may be stored in different indexes, making it impossible to search across them.
   • DThe data cannot be searched because it is in different formats.
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A Splunk admin is mapping a new data source to the CIM Network data model. The source provides a field 'dest_port' that represents the destination port. The admin notices that the CIM data model expects the field 'dest_port' as well. What is the most appropriate action?

   • ACreate a new custom data model for this source to avoid changing the field name.
   • BLeave the field as 'dest_port' because it already matches the CIM standard.
   • CMap the field to 'port' because that is the generic CIM field.
   • DRename the field to 'destination_port' to match the CIM standard.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is planning to normalize all firewall logs to CIM. They have a limited number of staff and a tight deadline. What is the most significant challenge they are likely to face during this effort?

   • ANormalization will make the data unreadable to analysts who are familiar with the original logs.
   • BThe team must map each vendor's unique field names to the CIM standard, which requires time and expertise.
   • CThe normalization process will reduce the storage capacity of the Splunk environment.
   • DThe normalization process will automatically delete any fields that are not mapped to CIM.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following best describes the structure of the Splunk CIM?

   • AA list of approved security vendors
   • BA collection of data models and field definitions organized by domain
   • CA set of predefined dashboards and reports
   • DA set of encryption algorithms for log data
   Reveal Solution Discussion Select an answer first