Explain How Cybersecurity Defense Data Architectures Scale Using Technologies and Capabilities Such as Data Mesh, Data Lakes, Message Bus, Message Routing, and Federated Search. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is designing a data lake to store both raw packet captures (PCAP) and parsed network flow logs. They need to support both deep forensic analysis on raw data and fast, frequent queries on parsed data. The team is concerned about storage costs and query performance. Which approach best balances these concerns?

   • AStore all data in a single high-performance tier to ensure fast query performance for all use cases.
   • BStore only parsed flow logs and discard raw PCAP to save storage costs.
   • CStore raw PCAP in a low-cost, cold storage tier and parsed flow logs in a high-performance tier, with schema-on-read for both.
   • DUse federated search to query PCAP files in place and avoid storing them in the data lake.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A multinational corporation has security data stored in regional data centers due to data residency requirements. The global SOC needs to run a single query across all regions to hunt for a specific threat indicator. Which approach allows this without copying data to a central location?

   • AUse federated search to query each regional data source in place and aggregate the results centrally.
   • BReplicate all regional data to a central data lake and run the query against the lake.
   • CHave each regional team run the query locally and email the results to the global SOC.
   • DUse a message bus to stream all regional data to the global SOC in real time for querying.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does a message bus contribute to scaling a cybersecurity data architecture to handle high data velocity?

   • ABy storing all data permanently for compliance
   • BBy buffering and distributing data asynchronously to multiple consumers
   • CBy transforming data into a single standardized format
   • DBy enforcing strict schema validation on all messages
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large organization is adopting a data mesh approach for its security data. Each business unit (BU) owns its security data as a product. The central security team wants to enforce a common data classification standard across all BU data products. However, BUs have different regulatory requirements and want flexibility in their data schemas. What is the most effective way to implement federated computational governance?

   • AUse federated search to query all BU data products and enforce policies at query time rather than at the data product level.
   • BDefine a set of global policies (e.g., data classification, retention) that all BU data products must implement, while allowing BUs to define their own schemas and local policies.
   • CLet each BU define its own policies and schemas without any central oversight to maximize flexibility.
   • DHave the central team define and enforce all data policies and schemas to ensure consistency across all BU data products.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which combination of technologies best supports scaling a security data architecture to handle the variety of data from diverse sources like endpoints, network devices, and cloud services?

   • ASingle centralized SIEM with no additional components
   • BRelational database with strict schema and point-to-point integration
   • CFederated search only, without any data storage
   • DData lake with schema-on-read and a message bus for ingestion
   Reveal Solution Discussion Select an answer first