Explain How Cybersecurity Defense Data Architectures Scale Using Technologies and Capabilities Such as Data Mesh, Data Lakes, Message Bus, Message Routing, and Federated Search. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to store raw DNS logs for historical analysis. The logs have a varying structure, and the team wants to be able to query them without a predefined schema. Which data lake feature enables this?

   • AFederated search, which queries data in its original source system.
   • BSchema-on-write, which validates and structures data at ingestion time.
   • CSchema-on-read, which applies a schema when the data is queried.
   • DData curation, which transforms raw data into a standard format before storage.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the defining characteristic of federated search in a cybersecurity environment?

   • AIt only works with cloud-based data sources
   • BIt requires all data sources to use the same schema
   • CIt copies all data into a single searchable index
   • DIt queries multiple distributed data sources without moving the data into a central repository
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A global retail company's security operations center (SOC) struggles because each regional security team manages its own detection rules and data pipelines independently, leading to duplicated effort and inconsistent threat coverage. The company wants to scale its cybersecurity data architecture while preserving regional autonomy and ensuring global visibility. Which approach best aligns with data mesh principles?

   • AHave each regional team own and publish its security data as a product, with a self-serve platform and federated governance for global standards.
   • BRoute all regional security data through a single message bus to a central team that curates and distributes detection rules back to regions.
   • CUse federated search to query each region's data in place, but keep all detection rules and data schemas centrally managed by the global SOC.
   • DCentralize all security data into a single data lake and have the global SOC create and manage all detection rules centrally.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's network security team and endpoint security team each produce security logs. The threat hunting team needs access to both datasets for correlation. In a data mesh model, how should the threat hunting team access this data?

   • AThe threat hunting team should directly access the raw log sources of both teams.
   • BThe central IT team should create a single combined dataset and provide it to the threat hunting team.
   • CThe network and endpoint teams should publish their data as products, and the threat hunting team should consume those products.
   • DThe threat hunting team should request that both teams send them copies of all logs via email.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational company has security data in multiple regional Splunk deployments. They want to implement a federated search across these deployments. However, they are concerned about the performance impact on the regional deployments when global searches are run. What is the best way to mitigate this concern?

   • ARun global searches during off-peak hours to minimize the impact on regional deployments.
   • BUse federated search with resource limits and timeouts to control the load on each regional deployment.
   • CReplicate all regional data to a central deployment to avoid impacting regional systems.
   • DHave each regional team run the search manually and limit the scope to reduce load.
   Reveal Solution Discussion Select an answer first