Ensure Appropriate Technologies and Processes Are in Place to Support Various Forensics Investigations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When collecting digital evidence from Splunk for a forensic investigation, what is the primary purpose of documenting the chain of custody?

   • ATo reduce the amount of data that needs to be analyzed
   • BTo encrypt the evidence so that only authorized personnel can read it
   • CTo ensure that the evidence is stored in a secure location
   • DTo provide a chronological record of who accessed and handled the evidence
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is implementing forensic readiness and needs to ensure that the Splunk environment can support investigations that require high-fidelity data. The current setup uses a single index for all data with a 30-day retention. The investigation team often needs data that is older than 30 days. What is the most effective way to improve the environment?

   • ACreate separate indexes for different data types and set appropriate retention periods for each.
   • BEnable the audit index to track all user activity in Splunk.
   • CIncrease the retention period for the single index to 1 year.
   • DUse a data model to accelerate searches on the existing index.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A legal hold has been placed on a user's data due to an ongoing lawsuit. The data is stored in Splunk. The architect needs to ensure that this data is not deleted by the standard retention policy. What is the most appropriate action?

   • AIncrease the retention period for the specific index containing the user's data.
   • BUse the 'freeze' command on the specific buckets containing the user's data.
   • CCreate a saved search that exports the user's data to a separate, non-expiring index.
   • DConfigure a data model or report to retain the user's data indefinitely.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A global company is subject to both GDPR and CCPA. They are designing a forensic investigation process that involves collecting personal data from Splunk logs. The legal team is concerned about cross-border data transfers. What is the most important factor to address in the process design?

   • AEnsure that the Splunk instance used for the investigation is located in the same region as the data subjects.
   • BObtain explicit consent from all data subjects before collecting their data for the investigation.
   • CAnonymize all personal data in Splunk logs before the investigation begins.
   • DDocument the legal basis for processing the personal data and implement appropriate safeguards for any cross-border transfers.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   During a data breach investigation, the legal team requires that evidence be collected in a way that maintains a clear chain of custody. The evidence includes logs from a critical database server that is still in production. The team cannot take the server offline. What is the most appropriate method to collect the logs?

   • AUse the Splunk Universal Forwarder to stream the logs to a dedicated forensic index, and record the collection time and source.
   • BCopy the log files to a USB drive using a standard file copy command.
   • CRun a Splunk search to extract the relevant logs and save the results to a PDF file.
   • DTake a full disk image of the database server using a hardware write-blocker.
   Reveal Solution Discussion Select an answer first