Determine How Coverage Gaps Can Be Mitigated by Architecture Changes, Config Changes, or Process Changes. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   What is the primary purpose of identifying coverage gaps in a Splunk deployment?

   • ATo compare current security capabilities against required coverage to find weaknesses
   • BTo ensure all data sources are ingested into Splunk regardless of cost
   • CTo reduce the number of security alerts generated by Splunk
   • DTo replace all existing security tools with Splunk
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A Splunk architect is conducting a coverage review and finds that the SOC has no visibility into the activities of privileged users on a critical mainframe. The mainframe logs are not being collected, and the mainframe team is resistant to installing any new software. Which mitigation approach should the architect recommend?

   • AUse a syslog forwarder on a separate log aggregation server to receive the mainframe logs and forward them to Splunk.
   • BInstall a Splunk universal forwarder on the mainframe to collect the logs directly.
   • CCreate a correlation search that looks for privileged user activity in the existing security logs.
   • DUpdate the SOC playbook to manually review mainframe logs when a privileged user is suspected of malicious activity.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A Splunk architect discovers that the SOC is not responding to alerts for lateral movement because the alerts are generated, but the on-call analyst does not know which playbook to follow. The playbooks are stored in a wiki that is rarely updated. Which mitigation approach best addresses this coverage gap?

   • ACreate a new correlation search that generates a more specific alert for lateral movement.
   • BIncrease the severity of the lateral movement alerts so they are prioritized by the SOC.
   • CAdd a new index for lateral movement data and configure the forwarders to send additional logs.
   • DUpdate the playbook and integrate it into the alert action so the analyst sees the correct response steps directly in Splunk.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A Splunk architect is reviewing coverage for a new compliance requirement that mandates a response to security incidents within 15 minutes. The current alerting system generates alerts, but the SOC analysts are not responding quickly because the alerts are not prioritized and the playbooks are outdated. The architect must choose between updating the playbooks and reconfiguring the alert system. Which mitigation approach should the architect prioritize?

   • AReconfigure the alert system to send all alerts to a single queue for faster triage.
   • BUpdate the playbooks and integrate them into the alert actions so analysts have clear, current response steps.
   • CDeploy a new SIEM platform that has built-in incident response automation.
   • DAdd more correlation searches to generate more alerts, hoping that more alerts will lead to faster response.
   Reveal Solution Discussion Select an answer first