Determine How Coverage Gaps Can Be Mitigated by Architecture Changes, Config Changes, or Process Changes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Splunk deployment is missing coverage for detection of brute-force attacks on a VPN appliance. The VPN logs are being collected, but the correlation search for brute force is not firing. The architect discovers that the VPN logs use a non-standard timestamp format that Splunk is not parsing correctly. Which configuration change should the architect make?

   • AAdd a new index for the VPN logs and configure the forwarder to send them there.
   • BUpdate the props.conf on the indexer to define the correct timestamp format for the VPN logs.
   • CChange the correlation search to use a longer time range to capture more events.
   • DDeploy a new heavy forwarder to parse the VPN logs before they reach the indexer.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How can a process change mitigate a coverage gap in a Splunk deployment?

   • ABy changing the sourcetype for a data input
   • BBy updating the incident response playbook to include a new alert type
   • CBy adding a new indexer to the cluster
   • DBy installing a new Splunk app for threat intelligence
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When selecting a mitigation approach for a coverage gap, what is the key factor to consider?

   • AThe complexity of the change is the only consideration
   • BThe nature of the gap and the most effective way to address it
   • CThe cost of the change is always the most important factor
   • DThe preference of the security team
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Splunk architect is reviewing coverage for a new threat intelligence feed. The feed is being ingested and correlated, but the SOC is not acting on the alerts because the alerts are not integrated into the existing incident management workflow. Which mitigation approach best addresses this coverage gap?

   • ACreate a new dashboard to visualize the threat intelligence alerts.
   • BDeploy a new indexer to handle the additional data from the threat intelligence feed.
   • CUpdate the alert actions to automatically create tickets in the existing incident management system.
   • DAdd more correlation searches to generate more alerts from the threat intelligence feed.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Splunk architect is designing a solution to close a coverage gap for network traffic analysis. The SOC needs to analyze NetFlow data, but the current forwarders are not capable of handling the volume. The architect must choose between deploying a dedicated NetFlow collector or using the existing indexers to process the data. The network team wants to minimize the number of new components. Which approach should the architect take?

   • AUse a universal forwarder on the network devices to send NetFlow data directly to the indexers.
   • BDeploy a dedicated NetFlow collector that forwards the data to the existing indexers.
   • CConfigure the existing indexers to receive NetFlow data directly.
   • DCreate a correlation search that analyzes the existing firewall logs for network traffic patterns.
   Reveal Solution Discussion Select an answer first