Ensure That Resilient Solutions Aligned to the Business and Operational Requirements Are Selected and Deployed. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has deployed Splunk Enterprise Security in a hybrid cloud environment. The security team wants to ensure that the solution remains resilient to a failure of the cloud provider's services. The team also needs to maintain the ability to search data even if the cloud connection is lost. Which configuration should be implemented?

   • ADeploy all indexers on-premises and use the cloud only for storage.
   • BDeploy all indexers in the cloud and rely on the cloud provider's redundancy.
   • CDeploy indexers both on-premises and in the cloud, with replication between them, and configure the search head to use local indexers when the cloud connection is lost.
   • DConfigure the search head to cache all search results to avoid the need for cloud connectivity.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center (SOC) uses Splunk Enterprise Security to monitor network traffic. The team notices that during a distributed denial-of-service (DDoS) attack, the search head becomes unresponsive, and the SOC cannot run critical searches. The solution must be configured to maintain search availability during such load conditions. Which configuration should be applied?

   • AMove all search processing to the indexers to reduce the search head's load.
   • BDisable search head clustering to reduce overhead and improve performance.
   • CIncrease the search head's memory allocation and enable search head clustering.
   • DConfigure the search head to reject all search requests during high load.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A university's IT department uses Splunk Enterprise Security to monitor network activity. During the start of the semester, the volume of security events increases significantly, and the indexers are struggling to keep up, causing delays in indexing. The solution must be configured to handle the increased load without losing data. Which configuration should be applied?

   • ADisable indexing for less critical data sources to reduce the load.
   • BIncrease the number of indexers and configure load balancing across them.
   • CConfigure the forwarders to send data directly to the search head.
   • DReduce the retention period for indexed data to free up storage.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   During the requirements analysis phase for a cybersecurity solution, which activity is most directly associated with identifying resilience needs?

   • ATesting the solution's failover capabilities in a production environment
   • BConfiguring the solution's logging and alerting thresholds
   • CSelecting the specific security vendor and product version
   • DReviewing the organization's business continuity and disaster recovery objectives
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of validating a deployed cybersecurity solution against operational requirements?

   • ATo increase the solution's market share
   • BTo reduce the need for security monitoring
   • CTo confirm the solution continues to meet the organization's operational needs
   • DTo simplify the solution's architecture
   Reveal Solution Discussion Select an answer first