Develop Scalable Strategies for Agile and DevOps-driven Cybersecurity Defenses, Such as Detection as Code. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A large enterprise has hundreds of Splunk search heads and needs to deploy a new detection rule to all of them consistently. They want to avoid manual configuration and ensure that the same version is deployed everywhere. Which strategy should they use?

   • AUse a configuration management tool (e.g., Ansible, Puppet) to push the detection rule to all search heads from a central repository.
   • BEmail the rule to each search head administrator and ask them to apply it.
   • CUse a shared network drive and instruct each search head to read the rule from there.
   • DManually copy the rule to each search head via remote desktop.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team wants to automate the deployment of detection rules to their Splunk environment. They have a CI pipeline that builds and tests the rules, and they want to automatically deploy to production after a successful build. Which DevOps practice should they implement?

   • AContinuous monitoring
   • BContinuous integration
   • CContinuous deployment
   • DContinuous delivery
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has deployed a new detection rule that is generating a high number of false positives. They want to continuously improve the rule based on operational feedback. Which approach should they take?

   • ADisable the rule and never re-enable it.
   • BIncrease the rule's sensitivity to reduce false positives.
   • CIgnore the false positives and keep the rule as is.
   • DSet up a feedback loop where alerts are reviewed, false positives are documented, and the rule is updated in the next sprint.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is using Scrum to manage their detection backlog. They have a sprint review where they demonstrate new detections to stakeholders, and a sprint retrospective where they discuss what went well and what could be improved. Which agile value are they practicing?

   • ACustomer collaboration over contract negotiation
   • BResponding to change over following a plan
   • CWorking software over comprehensive documentation
   • DIndividuals and interactions over processes and tools
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team wants to implement continuous delivery for their detection rules. They have a CI pipeline that runs automated tests, but they are concerned about deploying to production automatically because of compliance requirements that require manual approval for production changes. Which practice should they adopt?

   • AContinuous delivery, which keeps the detections in a deployable state and requires a manual approval to deploy to production.
   • BManual deployment to production using a runbook.
   • CContinuous integration only, without any deployment automation.
   • DContinuous deployment, which automatically deploys to production after tests pass.
   Reveal Solution Discussion Select an answer first