Determine How Coverage Gaps Can Be Mitigated by Architecture Changes, Config Changes, or Process Changes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Splunk architect is addressing a coverage gap for detection of phishing emails. The email gateway logs are being collected, but the SOC is not detecting phishing because the correlation search relies on a threat intelligence feed that is only updated daily. The SOC wants to improve detection without adding new hardware. Which mitigation approach should the architect prioritize?

   • AUpdate the SOC playbook to manually review all emails flagged by the gateway.
   • BDeploy a new email sandbox to analyze suspicious emails.
   • CConfigure the correlation search to also use the email gateway's built-in spam score as a signal.
   • DIncrease the frequency of the threat intelligence feed updates to every hour.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Splunk deployment is missing coverage for detection of unauthorized changes to critical configuration files on Windows servers. The Windows servers are already forwarding Security and System logs, but the configuration file changes are not being detected. The architect discovers that the necessary audit policy is not enabled on the servers. Which configuration change should the architect make?

   • ADeploy a new forwarder on each server to collect configuration file hashes and compare them.
   • BCreate a new correlation search that looks for configuration file changes in the existing Security logs.
   • CEnable the Windows audit policy for file system access on the servers and configure the forwarder to collect the relevant event IDs.
   • DUpdate the SOC playbook to manually check configuration files on a regular basis.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of implementing a mitigation plan that coordinates multiple change types?

   • AOnly adding a new indexer
   • BOnly modifying a data input to collect more logs
   • COnly updating the incident response playbook
   • DAdding a new forwarder and updating the correlation search to use the new data
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can an architecture change mitigate a coverage gap in a Splunk deployment?

   • ABy creating a new playbook for incident response
   • BBy adding a new forwarder to collect logs from a previously unmonitored source
   • CBy modifying an existing correlation search to use a different time range
   • DBy updating the Splunk app to the latest version
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Splunk architect is planning to add a new data source for cloud infrastructure logs. The current deployment has a single indexer cluster and no heavy forwarders. The new data source will produce a high volume of logs that need to be parsed and enriched before indexing. Which architecture change should the architect implement?

   • AConfigure the indexer cluster to handle the parsing and enrichment directly.
   • BDeploy a heavy forwarder to parse and enrich the logs before sending them to the indexer cluster.
   • CAdd more search heads to handle the increased search load from the new data.
   • DUse a universal forwarder to send the logs directly to the indexer without any preprocessing.
   Reveal Solution Discussion Select an answer first