Describe the Value of Data Normalization in Order to Support Integration into Cybersecurity Defense Programs, Such as Security Monitoring and Threat Hunting, E.g. with CIM, CEF. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a common challenge of implementing data normalization?

   • AThe requirement to use a single vendor for all security tools
   • BThe effort required to map fields from diverse data sources
   • CThe inability to search across normalized data
   • DThe need to store all data in a single database
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC wants to create a correlation search that triggers an alert when a user logs in from a new geolocation and then performs a high-risk action. The authentication logs and application logs use different field names for the username. What is the most efficient way to enable this correlation?

   • ACreate two separate correlation searches and manually correlate the results.
   • BWrite the correlation search using the field names from the authentication logs only.
   • CUse a lookup table to convert usernames to IP addresses before running the correlation.
   • DNormalize both data sources to CIM so that the username field is consistent, then write the correlation search using the standard field name.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC is considering normalizing all data to CIM. They have a large volume of legacy logs with many fields that do not map cleanly to CIM. The team is concerned about the effort and potential data loss. Which approach best balances the benefits and challenges?

   • ANormalize every field to CIM, even if it requires creating custom CIM fields.
   • BNormalize only the fields that are required for the SOC's primary use cases, and preserve the original raw data for other fields.
   • CSkip normalization entirely and rely on the analysts to manually map fields during searches.
   • DNormalize all data to CIM but delete any fields that do not map to the standard.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC manager wants to create a single dashboard that shows failed login attempts from VPN, Active Directory, and cloud identity provider logs. Currently, each source uses a different field for the username and source IP. What is the most effective way to enable this unified dashboard?

   • ANormalize the data to a common schema, such as CIM, so that the username and source IP fields are consistent across all sources, then build a single dashboard.
   • BBuild three separate dashboard panels, one for each source, and place them side by side.
   • CUse a lookup table to translate the source IPs to usernames after the search runs.
   • DIngest only the VPN logs and ignore the other sources to simplify the dashboard.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How does CEF facilitate interoperability of security data across different systems?

   • ABy encrypting all event data with a shared key
   • BBy storing data in a central database
   • CBy using a common header and extension fields to describe events
   • DBy requiring all systems to use the same operating system
   Reveal Solution Discussion Select an answer first