Describe the Value of Data Normalization in Order to Support Integration into Cybersecurity Defense Programs, Such as Security Monitoring and Threat Hunting, E.g. with CIM, CEF. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a key consideration when mapping raw data fields to CIM?

   • AEnsure that all fields are mapped to the same name as the raw data
   • BEnsure that field values are converted to the correct data type and format
   • CEnsure that only fields from the raw data are used, no additional fields
   • DEnsure that the mapping is done only for data from trusted vendors
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security vendor wants to ensure that its new firewall can send logs to any SIEM without requiring custom parsers. Which approach best achieves this goal?

   • ASend logs in a binary format that is compressed for efficiency.
   • BSend logs as plain text with no structure, relying on the SIEM to infer the fields.
   • CSend logs in Common Event Format (CEF) because it is a widely adopted standard for security events.
   • DSend logs in a proprietary format that is optimized for the vendor's own SIEM.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is integrating a new data source that sends events in CEF. The SIEM already has a CEF parser, but the team notices that some events are not being parsed correctly because the vendor uses a non-standard extension key for the destination port. What is the best way to handle this?

   • AModify the SIEM's CEF parser to recognize the vendor's custom extension key and map it to the standard destination port field.
   • BIgnore the events with the non-standard key because they are not important.
   • CAsk the vendor to change their CEF implementation to use the standard 'dpt' key.
   • DSwitch to a different SIEM that can parse the vendor's custom key natively.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of data normalization in a cybersecurity defense program?

   • ATo encrypt all security data at rest and in transit
   • BTo convert diverse raw data into a common, consistent format
   • CTo reduce the storage footprint of security logs
   • DTo replace all security tools with a single SIEM platform
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the first step in mapping raw data fields to CEF-compliant fields?

   • ADetermine the CEF header fields and extension fields that apply to the event
   • BDelete any raw fields that do not have a CEF equivalent
   • CEncrypt the raw data before mapping
   • DCreate a new CEF version for each data source
   Reveal Solution Discussion Select an answer first