Identify High Value / High Signal / High Noise Data Sources (e.g. Windows Process vs EDR Process Flow, or network/VPC Flow vs Packet Capture) and How They Support Security Operations Use Cases. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the defining characteristic of a 'high signal' data source in security monitoring?

   • AIt generates a high volume of events per second.
   • BIt captures data from the network perimeter only.
   • CIt contains a high proportion of events that are directly relevant and actionable for security investigations.
   • DIt is the primary source used by the organization's SIEM for all detection rules.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC manager is reviewing the alert volume and notices that a specific data source generates a high number of false positives, overwhelming the analysts. The data source is valuable for detecting a specific type of attack, but the noise is causing alert fatigue. The manager needs to reduce the noise while preserving the detection capability. What is the best approach?

   • ADecrease the data retention period for that source
   • BIncrease the severity threshold for alerts from that source
   • CRemove the data source from the SIEM
   • DCreate a suppression rule that filters out known benign events from that source
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key difference between network/VPC flow data and packet capture data?

   • AFlow data provides summary metadata about connections, while packet capture provides the full packet contents.
   • BFlow data is always encrypted, while packet capture is always plaintext.
   • CFlow data contains the full payload of every packet, while packet capture only contains metadata.
   • DPacket capture is easier to store long-term because it is smaller than flow data.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   For a security operations use case focused on detecting large-scale network reconnaissance from an external IP, which data source is most suitable?

   • AWindows process logs
   • BNetwork flow data
   • CFile integrity monitoring logs
   • DEDR process flow data
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why are high value data sources considered important in security operations?

   • AThey always produce the highest number of security alerts, keeping analysts busy.
   • BThey provide the most direct visibility into the security of the organization's most critical systems and data.
   • CThey are the only data sources that can be used for compliance reporting.
   • DThey are the cheapest to store and retain for long periods of time.
   Reveal Solution Discussion Select an answer first