Explain How to Develop and Implement Integration Strategies for Data-Driven Security Operations. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is designing an integration architecture for security data that includes both on-premises and cloud sources. They have a requirement to keep all data within the country due to data residency regulations. What is the most important architectural consideration?

   • AUse a hybrid architecture with on-premises storage for all data
   • BEncrypt all data in transit and at rest
   • CEnsure that all data ingestion, processing, and storage occurs within a region that meets the data residency requirement
   • DUse a cloud provider that offers the most advanced security features
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations team is planning to integrate data from multiple sources into their Splunk environment. They have a mix of on-premises servers, cloud workloads, and SaaS applications. The team needs to ensure that the integration strategy aligns with their existing security monitoring goals and avoids overwhelming their analysts with noise. What should be the FIRST step in developing their integration strategy?

   • ASelect the most cost-effective data ingestion method for each source
   • BDeploy a universal forwarder to every data source to standardize collection
   • CDefine the security use cases and the data elements required to support them
   • DConfigure the Splunk Enterprise Security app to automatically detect and ingest all available data sources
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A managed security service provider (MSSP) is integrating security data from multiple customer environments into a single Splunk platform. They need to ensure that each customer's data is isolated and that access is strictly controlled. Which integration strategy best addresses this requirement?

   • ADeploy a separate Splunk instance for each customer
   • BUse separate indexes for each customer and implement role-based access controls
   • CIngest all data into a single index and rely on search-time filtering by customer
   • DUse a single index but tag events with customer IDs
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During integration testing, a team discovers that the data from a new source is arriving with incorrect time zones, causing events to appear in the wrong order. What is the best way to address this issue?

   • AAdjust the system clock on the forwarder to match the source's timezone
   • BIgnore the timezone issue because it only affects a small number of events
   • CConfigure the source type's timezone settings in props.conf to match the source's timezone
   • DUse a search-time conversion to adjust the timestamps
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After integrating a new data source, a security analyst notices that some events are missing timestamps and others have duplicate entries. What should the team do to address these data quality issues?

   • AIncrease the index size to accommodate the extra data
   • BManually correct the data in Splunk after ingestion
   • CImplement validation checks during ingestion to flag and handle missing or duplicate events
   • DIgnore the issues because they are rare and will not affect overall analytics
   Reveal Solution Discussion Select an answer first