Ensure Appropriate Technologies and Processes Are in Place to Support Various Forensics Investigations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization is designing its Splunk environment to support potential legal investigations. The legal team requires that all log data be retained for at least 7 years and that the data be easily searchable for e-discovery. The organization is concerned about storage costs. What is the most appropriate strategy?

   • AReduce the retention period to 1 year and rely on backups for older data.
   • BUse a multi-tier storage strategy: keep recent data in hot/warm storage and archive older data to cold or frozen storage that can be thawed when needed.
   • CStore all data in hot and warm storage for 7 years to ensure fast search performance.
   • DExport all logs to a data lake and use a separate analytics platform for searches.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise is planning its forensic readiness. The security team wants to ensure that all critical systems have adequate logging for future investigations. They have a limited budget and must prioritize which data sources to ingest into Splunk. Which approach best balances cost and forensic value?

   • AIngest all available logs from all systems to ensure no data is missing.
   • BFocus on ingesting only firewall logs, as they provide the most comprehensive view of network activity.
   • CPrioritize ingestion of authentication logs, endpoint logs, and network security logs, and document the rationale for each source.
   • DIngest logs from all servers but exclude workstation logs to save costs.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security analyst is performing forensic analysis on a security incident in Splunk. Which search command is most appropriate to identify the sequence of events leading up to the incident?

   • A`transaction`
   • B`eval`
   • C`lookup`
   • D`stats`
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When using Splunk to support forensic investigations, what is a key legal consideration regarding data residency?

   • AData must be encrypted at all times to comply with legal requirements
   • BData must be accessible to law enforcement at any time
   • CAll data must be stored in the same country where the incident occurred
   • DData must be stored in a location that complies with the applicable data protection regulations
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Splunk feature is most useful for preserving the integrity of evidence during a forensic investigation?

   • ASplunk's data model acceleration
   • BSplunk's ability to compress indexed data
   • CSplunk's ability to export search results to a CSV file
   • DSplunk's audit log that records who accessed and searched data
   Reveal Solution Discussion Select an answer first