Determine How Coverage Gaps Can Be Mitigated by Architecture Changes, Config Changes, or Process Changes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a process change that could mitigate a coverage gap?

   • ACreating a new workflow for escalating high-priority alerts to the SOC manager
   • BDeploying a new search head for better performance
   • CUpdating the Splunk Enterprise license to increase data volume
   • DAdding a new data input for firewall logs
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk architect is reviewing a security deployment that ingests firewall logs, but the SOC recently discovered that a critical internal application's authentication logs are not being collected. The application runs on a Linux server that is not currently a Splunk forwarder. Which mitigation approach should the architect prioritize to close this coverage gap?

   • AAdd a new index for the application's logs and configure the indexer to listen on a new port.
   • BCreate a new correlation search that alerts on the absence of authentication events from the application server.
   • CUpdate the SOC's playbook to manually review the application's logs on the server when an incident is suspected.
   • DInstall a universal forwarder on the Linux server and configure it to send the application's authentication logs to the indexer.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A Splunk architect is addressing a coverage gap for detection of insider threats. The SOC has access to employee badge access logs, but they are not being collected. The facilities team is concerned about the privacy implications of collecting badge data. The architect must choose between collecting the data and implementing a process to handle the privacy concerns. Which mitigation approach should the architect prioritize?

   • ADo not collect the badge data and rely on other security logs for insider threat detection.
   • BCollect the badge access logs and implement a process to restrict access to the data and ensure it is used only for security purposes.
   • CCollect the badge data and store it in a separate index with no access controls.
   • DDeploy a new forwarder to collect the badge data, but do not create any correlation searches.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which activity is an example of identifying a coverage gap in a Splunk deployment?

   • AAdding a new Splunk index to store additional log data
   • BReviewing the MITRE ATT&CK framework and noting that no detection exists for a specific technique
   • CUpdating the Splunk Enterprise license to increase daily volume
   • DTuning an existing correlation search to reduce false positives
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the first step in implementing a mitigation plan for a coverage gap?

   • ANotify all users of the change
   • BImmediately deploy new hardware
   • CEvaluate the cost of the change
   • DDefine the specific changes needed to address the gap
   Reveal Solution Discussion Select an answer first