Identify High Value / High Signal / High Noise Data Sources (e.g. Windows Process vs EDR Process Flow, or network/VPC Flow vs Packet Capture) and How They Support Security Operations Use Cases. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC team is evaluating a new data source that generates a large volume of events, but only a small fraction are related to security incidents. The team wants to use this source for detection without overwhelming their analysts. What is the most effective approach?

   • AStore the data but do not alert on it
   • BIngest only events that match specific security use cases
   • CIngest all events and rely on alerting to filter out noise
   • DSample the data source to reduce volume
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC team is overwhelmed by alerts from their SIEM. They notice that a large number of alerts are triggered by routine administrative activities, such as scheduled tasks and legitimate software updates. The team wants to reduce alert fatigue while maintaining visibility into genuine threats. Which approach would best address this issue?

   • AImplement alert tuning and suppression rules for known benign activities
   • BDisable all alerts from Windows event logs
   • CIncrease the severity threshold for all alerts
   • DSwitch to a different SIEM platform
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst needs to detect data exfiltration attempts that involve large file transfers over the network. The organization has limited storage for log data and needs a solution that provides high signal with manageable noise. Which data source would best meet this requirement?

   • ANetFlow or VPC flow logs
   • BDNS logs
   • CProxy logs
   • DFull packet capture (PCAP)
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security architect is designing a monitoring strategy for a financial institution. The institution is most concerned about insider threats and credential misuse. Which data source would be considered high value for this specific concern?

   • APrinter logs
   • BAuthentication logs
   • CWeather data
   • DEmployee badge access logs
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC team is evaluating a new data source that provides detailed endpoint activity but generates a high volume of events. The team wants to use this source for threat hunting but is concerned about the storage and processing costs. They need to balance the value of the data with the operational overhead. What is the most effective approach?

   • AStore the data in a low-cost storage tier and only search it when needed
   • BIngest all events and use data models to optimize search performance
   • CIngest only events that match specific threat hunting use cases
   • DSample the data to reduce volume
   Reveal Solution Discussion Select an answer first