Explain How Cybersecurity Defense Data Architectures Scale Using Technologies and Capabilities Such as Data Mesh, Data Lakes, Message Bus, Message Routing, and Federated Search. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A large enterprise has multiple security tools (EDR, NDR, SIEM) that need to consume authentication logs from a central identity provider. The identity team wants to publish logs once without knowing which downstream systems need them. Which message routing pattern best supports this decoupling?

   • ATopic-based routing, where the identity team publishes logs to a topic and each tool subscribes to receive them.
   • BFederated search, where each tool queries the identity provider's logs directly when needed.
   • CContent-based routing, where the message bus inspects each log and sends it to the specific tool that needs it.
   • DPoint-to-point queues, where the identity team sends a copy of each log to each tool's dedicated queue.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations center is experiencing data loss during peak traffic because the ingestion pipeline cannot keep up with the volume. They want to add a buffer between data sources and the analytics platform. Which technology should they add?

   • AData mesh, to distribute data ownership and reduce the load on the central pipeline.
   • BFederated search, to query sources directly and reduce the load on the analytics platform.
   • CA message bus, to decouple producers and consumers and buffer messages.
   • DA data lake, to store raw data for later analysis.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which characteristic of a data lake allows security analysts to store raw logs in their native format and apply structure only when the data is read for analysis?

   • AACID transactions
   • BETL processing
   • CSchema-on-read
   • DSchema-on-write
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common challenge when implementing federated search across multiple security data sources?

   • ARequirement for a single centralized index
   • BIncreased storage costs due to data duplication
   • CInability to query cloud-based data
   • DLatency and performance variability across sources
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst needs to search for a specific file hash across multiple isolated network segments that each have their own log storage. The analyst wants a single query interface. Which technology should be used?

   • AMessage bus, to stream logs from all segments to a central analytics tool.
   • BData lake, to consolidate all logs into one place for querying.
   • CFederated search, to query each segment's log storage in place.
   • DData mesh, to have each segment publish its data as a product for central querying.
   Reveal Solution Discussion Select an answer first