Develop a Data Lifecycle Management Strategy, Including Retention, Storage Tiering, Summarization, Data Residency, and Access Control. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A global company uses Splunk Cloud in the US. They have a new requirement to store all data of EU citizens in the EU. They also want to maintain a single search experience for their global SOC. Which architecture should the architect recommend?

   • ADeploy a second Splunk Cloud stack in the EU and use federated search to query both stacks from a single search head.
   • BDeploy an on-premises Splunk Enterprise in the EU and use a universal forwarder to send EU data there, while keeping the US stack for global search.
   • CUse the existing US Splunk Cloud stack and apply data masking to EU data before indexing.
   • DUse the existing US Splunk Cloud stack and configure a data residency policy to route EU data to an EU-based cold storage.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of summary indexing in Splunk?

   • ATo reduce storage overhead by compressing data
   • BTo pre-compute and store results of frequently run searches
   • CTo manage data retention policies
   • DTo store raw data for compliance
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which data lifecycle stage in Splunk involves moving data to a location where it is no longer searchable but can be restored if needed?

   • ASummarization
   • BDeletion
   • CCold
   • DFrozen
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A global bank uses Splunk Enterprise on-premises in two data centers: one in Frankfurt (EU) and one in Singapore (APAC). They ingest transaction logs from both regions. EU regulations require that EU customer data be stored and processed only in the EU. The bank wants to use a single Splunk deployment for global visibility. Which architecture should the architect recommend?

   • ADeploy two separate Splunk indexer clusters, one in each region, and use search head clustering to search both from a single interface.
   • BDeploy a single Splunk indexer cluster in Frankfurt and have all data forwarded there.
   • CUse a single indexer cluster in Frankfurt and configure a data residency policy to route EU data to a local cold tier.
   • DDeploy a single indexer cluster in Singapore and use data masking to anonymize EU data before indexing.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A security team must retain raw event data for 18 months to meet a compliance requirement, but indexed data only needs to be searchable for 6 months. Which Splunk feature allows the team to keep raw data while removing the indexed data after 6 months?

   • ASummary indexing
   • BSearch head clustering
   • CIndex lifecycle policies
   • DData model acceleration
   Reveal Solution Discussion Select an answer first