Explain How Cybersecurity Defense Data Architectures Scale Using Technologies and Capabilities Such as Data Mesh, Data Lakes, Message Bus, Message Routing, and Federated Search. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security operations team is using a message bus to distribute alerts. Some consumers (e.g., ticketing system) need all alerts, while others (e.g., threat hunting) need only alerts related to specific malware families. The team wants to minimize the load on consumers and avoid them receiving irrelevant data. Which routing strategy is most appropriate?

   • AUse a single topic for all alerts and have each consumer filter the messages it receives.
   • BUse content-based routing so the bus delivers each alert only to consumers whose subscription criteria match the alert content.
   • CUse point-to-point queues with a separate queue for each consumer and have producers send copies of each alert to every queue.
   • DUse federated search for consumers to query the alert store when needed instead of pushing alerts.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a data mesh architecture, which principle assigns responsibility for a specific security dataset (e.g., firewall logs) to the team that best understands its meaning and usage?

   • ADomain-oriented data ownership
   • BSelf-serve data platform
   • CFederated computational governance
   • DData as a product
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is setting up a message bus to distribute authentication events. They want to ensure that a new consumer (e.g., a new analytics tool) can start receiving events without requiring changes to the authentication system. Which message bus capability enables this?

   • AFederated search, where consumers query the authentication system directly.
   • BTopic-based publish/subscribe, where the producer publishes to a topic and any consumer can subscribe.
   • CContent-based routing, where the bus routes events based on their content to specific consumers.
   • DPoint-to-point queues, where the producer sends events to a specific queue for each consumer.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is using a message bus to route security alerts. They have a critical alert type that must be processed immediately, and a less critical type that can be processed later. The team wants to ensure that critical alerts are not delayed behind less critical ones. Which message bus feature should they use?

   • ATopic-based routing, with all alerts on a single topic and consumers filtering by priority.
   • BContent-based routing, to send critical alerts to a different topic than less critical alerts.
   • CFederated search, to query alerts directly from the source when needed.
   • DPoint-to-point queues, with a separate queue for critical alerts and a dedicated consumer for that queue.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary role of a message bus in a security data pipeline?

   • ATo enforce security policies on data access
   • BTo store raw security data for long-term retention
   • CTo transform data formats before analysis
   • DTo decouple data producers from consumers
   Reveal Solution Discussion Select an answer first