Determine How Coverage Gaps Can Be Mitigated by Architecture Changes, Config Changes, or Process Changes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Splunk deployment is missing coverage for DNS query logs from a fleet of Windows servers. The SOC wants to detect DNS tunneling. The servers are already running the Splunk Universal Forwarder, but the DNS logs are not being indexed. What is the most appropriate mitigation approach?

   • AUpdate the incident response playbook to manually check DNS logs on each server during an investigation.
   • BConfigure the forwarder to monitor the DNS server debug log file and add a new data input.
   • CDeploy a new heavy forwarder in front of the DNS servers to parse and forward logs.
   • DCreate a new correlation search that looks for DNS tunneling by querying the Windows Event Log index.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an architecture change that could mitigate a coverage gap?

   • AWriting a new correlation search for lateral movement
   • BChanging the index time format in props.conf
   • CDeploying a heavy forwarder to parse and filter data before it reaches the indexer
   • DScheduling a weekly review of detection coverage
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Splunk deployment is missing coverage for insider threat detection. The SOC has access to HR data, but it is not integrated into Splunk. The HR team is reluctant to grant direct database access due to privacy concerns. Which mitigation approach would best address this coverage gap while respecting the HR constraint?

   • AConfigure a database input to connect directly to the HR database and pull the data.
   • BUpdate the correlation searches to use only the existing security logs and ignore HR data.
   • CDeploy a new forwarder on the HR database server to collect logs directly.
   • DCreate a process where HR exports relevant data to a secure file share that Splunk can monitor.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A Splunk architect is planning to close a coverage gap for cloud security monitoring. The organization uses AWS and Azure, and the current deployment only collects AWS CloudTrail logs. The architect needs to add Azure activity logs. The team wants to minimize the number of new components and avoid complex configurations. Which architecture change should the architect implement?

   • ADeploy separate forwarders for AWS and Azure to collect the logs independently.
   • BDeploy a single heavy forwarder that collects both AWS CloudTrail and Azure activity logs using the appropriate add-ons.
   • CConfigure the indexers to directly pull Azure activity logs using the Azure add-on.
   • DUse the existing AWS CloudTrail forwarder to also collect Azure activity logs.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a configuration change that could mitigate a coverage gap?

   • ADeploying a new search head cluster for high availability
   • BModifying a correlation search to detect a new attack technique
   • CImplementing a new workflow for alert triage
   • DAdding a new forwarder to collect DNS logs
   Reveal Solution Discussion Select an answer first