A Splunk architect is configuring access control for a new data source that contains credit card numbers. The compliance team requires that only the fraud investigation team can view the full credit card numbers, while other security analysts can see the last four digits. The data is indexed in a single index. What should the architect configure?

Use a data model to restrict access to the credit card field.

Create two roles: one with full access to the index and one with restricted access, and use field-level masking for the restricted role.

Create two separate indexes: one for full credit card numbers and one for masked data.

Use a search-time extraction to remove the credit card field from all search results.

Which Splunk feature allows you to restrict which users can access specific indexed data based on their role?

Role-based access control (RBAC)

What is the purpose of data masking in Splunk?

To compress data to save storage space

To hide sensitive fields from unauthorized users

To delete data after a retention period

SplunkCertified Cybersecurity Defense Architect

Domain 2Objective 5

Develop a Data Lifecycle Management Strategy, Including Retention, Storage Tiering, Summarization, Data Residency, and Access Control. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Part of the Security Data Management domain, which accounts for 20% of the CYBERSECURITY-DEFENSE-ARCHITECT exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

6concepts

20%of the exam

Questions 11–15

11foundation · easy
In a Splunk deployment, which stage of the data lifecycle involves parsing and transforming raw data into searchable events?
Select an answer first
12application · medium
A Splunk architect is configuring access control for a new data source that contains credit card numbers. The compliance team requires that only the fraud investigation team can view the full credit card numbers, while other security analysts can see the last four digits. The data is indexed in a single index. What should the architect configure?
Select an answer first
13foundation · easy
Which Splunk feature allows you to restrict which users can access specific indexed data based on their role?
Select an answer first
14foundation · easy
What is the purpose of data masking in Splunk?
Select an answer first
15foundation · easy
In Splunk's storage tiering, which tier provides the fastest search performance and is typically used for the most recent data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CYBERSECURITY-DEFENSE-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ARCHITECT” is a trademark of its owner, used for identification only.

Develop a Data Lifecycle Management Strategy, Including Retention, Storage Tiering, Summarization, Data Residency, and Access Control. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

In a Splunk deployment, which stage of the data lifecycle involves parsing and transforming raw data into searchable events?

Which Splunk feature allows you to restrict which users can access specific indexed data based on their role?

What is the purpose of data masking in Splunk?

In Splunk's storage tiering, which tier provides the fastest search performance and is typically used for the most recent data?

Keep studying — Security Data Management