Develop Scalable Strategies for Agile and DevOps-driven Cybersecurity Defenses, Such as Detection as Code. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations team is transitioning to an agile approach for managing their detection content. They want to plan their work in short iterations, prioritize based on threat intelligence, and incorporate feedback from incident response after each iteration. Which agile practice should they adopt?

   • AUse a Kanban board with a continuous flow of detection tasks and no fixed iteration length.
   • BUse a waterfall approach with a long-term plan for detection development.
   • CUse a simple to-do list managed by the team lead, updated monthly.
   • DUse Scrum with sprint planning, a sprint backlog, and a sprint retrospective to review feedback and adjust priorities.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is building a new detection rule and wants to ensure it is maintainable and testable. They plan to store the rule in a Git repository, write unit tests for the logic, and integrate it into a CI pipeline. Which practice does this exemplify?

   • ADetection as code
   • BSecurity orchestration
   • CIncident response
   • DThreat hunting
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is using Scrum to manage detection development. They have a two-week sprint, but they are struggling to complete all planned detections because of urgent incident response requests. They want to maintain agile principles while accommodating urgent work. What should they do?

   • AUse a separate work queue for urgent requests and pull them into the sprint only if capacity allows.
   • BCancel the sprint and start a new one with the urgent requests.
   • CExtend the sprint duration to accommodate the urgent requests.
   • DAdd urgent requests to the current sprint without adjusting the sprint goal.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to automate the deployment of security detections to multiple Splunk environments (development, staging, production). They want each change to go through the same pipeline: validate, test, and then deploy to production only after successful staging. Which approach best achieves this?

   • AManually copy detection files from development to production using a shared network drive.
   • BDeploy directly to production from the feature branch after a developer commits.
   • CCreate a CI/CD pipeline that builds the detection package, runs automated tests, and promotes the package through environments with approval gates.
   • DUse a script that deploys to all environments simultaneously without any testing.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which practice is a core principle of detection as code?

   • ADeploying detections directly to production without review
   • BKeeping detection logic only in the SIEM interface
   • CStoring detection logic in version control
   • DUsing manual testing for every detection change
   Reveal Solution Discussion Select an answer first