Ensure Appropriate Technologies and Processes Are in Place to Support Various Forensics Investigations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which process is a key component of forensic readiness planning in a Splunk environment?

   • ASetting up a public-facing dashboard to display security metrics
   • BDefining data sources and ensuring their logs are ingested into Splunk
   • CInstalling antivirus software on all endpoints
   • DConfiguring Splunk to automatically delete all logs after 30 days
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an active incident, the incident response team needs to collect evidence from a compromised Linux host. The host is not currently forwarding logs to Splunk. The team must preserve the evidence in a forensically sound manner while minimizing the impact on the running system. What is the most appropriate first step?

   • AInstall the Splunk Universal Forwarder and configure it to send all relevant log files to the Splunk indexer.
   • BCreate a bit-for-bit image of the host's disk using a forensic tool and hash the image with SHA-256.
   • CCopy the /var/log directory to a USB drive and then import the files into Splunk for analysis.
   • DRun a series of Splunk search commands against the host's live file system to extract relevant artifacts.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services company is preparing for potential regulatory investigations. The compliance team requires that any data used in a future forensic investigation be verifiably unaltered since collection. The Splunk environment currently stores all security logs in a standard index with default retention. What should the architect configure to meet this requirement?

   • AConfigure the index to use a custom timestamp format and enable the audit index for all user activity.
   • BEnable indexer acknowledgment and configure a frozen data archive to S3 with object lock enabled.
   • CSet up a scheduled search that exports all events to a CSV file stored on a network share.
   • DIncrease the index retention period to 10 years and enable search-time field extraction for all sourcetypes.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A Splunk architect is designing a forensic readiness plan for an organization that must support multiple types of investigations. Which technology capability is most essential to include in the plan?

   • AA real-time alerting system that notifies analysts of potential incidents as they occur
   • BA comprehensive data retention and archiving strategy that preserves logs for the required investigation period
   • CA vulnerability scanning tool that identifies weaknesses in the network
   • DA user training program that teaches employees how to recognize phishing emails
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which legal requirement is most directly supported by Splunk's ability to retain and search large volumes of log data?

   • AData minimization principles
   • BData portability requirements
   • CUser consent requirements
   • DRegulatory requirements for evidence preservation
   Reveal Solution Discussion Select an answer first