Identify High Value / High Signal / High Noise Data Sources (e.g. Windows Process vs EDR Process Flow, or network/VPC Flow vs Packet Capture) and How They Support Security Operations Use Cases. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security architect is designing a data collection strategy for a new SIEM deployment. The organization has limited budget for log storage and wants to prioritize data sources that provide the most value for detecting and investigating security incidents. Which data source should be prioritized?

   • AWeather data logs
   • BPrinter logs
   • CEmployee badge access logs
   • DAuthentication logs from domain controllers
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In terms of signal and noise, how does packet capture data typically compare to network flow data?

   • AFlow data has higher signal because it is filtered to only show malicious traffic.
   • BFlow data has lower signal because it lacks the payload needed to confirm an attack.
   • CPacket capture has lower signal because it contains vast amounts of irrelevant payload data, making it harder to find specific threats.
   • DPacket capture has higher signal because it contains more data.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is investigating a potential advanced persistent threat (APT) that has been evading detection for months. They have access to both Windows Security Event logs and EDR process flow data. The team needs to identify the initial infection vector and the full scope of the attack. Which approach would be most effective?

   • AUse EDR process flow data to trace the attack chain from the initial infection to current activity
   • BUse DNS logs to identify all domain queries
   • CUse Windows Security Event logs to identify all process creations
   • DUse network flow logs to identify all external connections
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise is experiencing performance issues with their SIEM due to the high volume of network data being ingested. They currently collect full packet capture for all traffic. The security team wants to reduce the load while maintaining the ability to detect and investigate network-based threats. What is the most effective strategy?

   • ADisable network monitoring entirely
   • BReplace full packet capture with NetFlow logs for all traffic
   • CContinue full packet capture but only store it for 24 hours
   • DUse a sampling rate of 10% for packet capture
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a primary challenge posed by 'high noise' data sources in security monitoring?

   • AThey contain a large amount of irrelevant data that can obscure important security events.
   • BThey are always generated by external attackers attempting to probe the network.
   • CThey produce data that is encrypted and cannot be analyzed.
   • DThey are difficult to integrate with the SIEM because of proprietary formats.
   Reveal Solution Discussion Select an answer first