Determine How Coverage Gaps Can Be Mitigated by Architecture Changes, Config Changes, or Process Changes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Splunk architect is reviewing coverage for a new compliance requirement that mandates monitoring of all administrative actions on a critical database. The database logs are already being collected, but the SOC is not seeing any alerts for unauthorized administrative changes. The architect suspects the logs are not being parsed correctly. Which configuration change should the architect make first?

   • ADeploy a new heavy forwarder to parse the database logs before they reach the indexer.
   • BCreate a new index for the database logs and configure the forwarder to send them to that index.
   • CUpdate the correlation search to use a broader search string that matches any log from the database.
   • DReview and update the props.conf and transforms.conf on the indexer to correctly extract the administrative action fields.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Splunk architect is reviewing coverage for a new regulation that requires monitoring of all access to customer data. The application logs are being collected, but the SOC is overwhelmed by the volume of alerts and is missing critical alerts. The architect determines that the correlation searches are too broad. Which mitigation approach best addresses this coverage gap?

   • AUpdate the SOC playbook to require manual review of all alerts.
   • BAdd more correlation searches to cover more access patterns.
   • CDeploy a new indexer to handle the increased data volume.
   • DRefine the correlation searches to reduce false positives and focus on high-risk access patterns.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Splunk deployment is missing coverage for detection of data exfiltration via DNS. The SOC has access to DNS logs, but they are not being collected. The network team is concerned about the additional load on the DNS servers if a forwarder is installed. Which mitigation approach best addresses this coverage gap while minimizing the impact on the DNS servers?

   • ACreate a correlation search that uses the existing firewall logs to detect DNS exfiltration.
   • BUpdate the SOC playbook to manually review DNS logs on the servers during an investigation.
   • CInstall a universal forwarder directly on each DNS server to collect the logs.
   • DConfigure the DNS servers to send logs to a central syslog server, and then use a Splunk forwarder to collect from that syslog server.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How can a configuration change mitigate a coverage gap in a Splunk deployment?

   • ABy creating a new incident response playbook
   • BBy adding a new indexer to handle increased data volume
   • CBy purchasing a new Splunk app for threat intelligence
   • DBy adjusting a data input to include additional log files from a source that was only partially monitored
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Splunk deployment is missing coverage for encrypted traffic analysis. The SOC wants to detect malicious TLS certificates, but the current forwarders only collect firewall logs. The network team is concerned about the performance impact of decrypting traffic at the firewall. Which architecture change would best mitigate this coverage gap?

   • ACreate a correlation search that looks for TLS certificates in the firewall logs.
   • BConfigure the firewall to decrypt all outbound traffic and send the decrypted logs to Splunk.
   • CUpdate the SOC playbook to manually inspect TLS certificates using external tools when an alert is triggered.
   • DDeploy a network sensor that captures TLS metadata and forwards it to Splunk for analysis.
   Reveal Solution Discussion Select an answer first