Implement Security Analytics Strategies Beyond Traditional SIEM Such as Advanced Techniques Like Data Science, Machine Learning, Behavioral Analysis, and AI. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A global bank uses Splunk ES to monitor transactions. The fraud team wants to use AI to detect money laundering patterns. They have labeled data of confirmed money laundering cases and non-fraudulent transactions. The bank's compliance officer requires that every alert generated by the AI model be explainable to auditors. Which approach best satisfies the need for both accurate detection and explainability?

   • AUse a transparent classification model such as logistic regression or a decision tree, which provides feature weights or rules that can be explained to auditors.
   • BUse a regression model to predict the dollar amount of each transaction and flag transactions that are unusually large.
   • CUse a clustering algorithm to group transactions and flag any transaction in a cluster with a high proportion of money laundering cases, without explaining why.
   • DUse a deep neural network with many hidden layers, which offers high accuracy but provides no inherent explanation for its predictions.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key role of artificial intelligence (AI) in security operations?

   • AAutomating the detection of threats and assisting in response decisions by analyzing large volumes of data
   • BEliminating the need for security monitoring tools
   • CGuaranteeing that no security incidents will occur
   • DReplacing all human security analysts with fully autonomous systems
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Splunk architect is implementing UEBA (User and Entity Behavior Analytics) for a manufacturing company. The company has a mix of human users and IoT devices (e.g., sensors, cameras) that connect to the network. The architect wants to detect compromised IoT devices, which often exhibit unusual communication patterns. Which approach is most effective for establishing baselines for both humans and IoT devices?

   • AUse a single global baseline for all entities, since they all communicate over the same network.
   • BApply a classification model to label each entity as 'human' or 'IoT' and then use a static rule to alert on any IoT device that communicates with a known bad IP.
   • CUse a regression model to predict the number of connections each entity will make per hour and alert on any entity that exceeds the predicted count by 50%.
   • DCreate separate behavioral baselines for human users and IoT devices, since their normal communication patterns differ significantly, and apply anomaly detection to each group.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Splunk architect is working with a retail company that experiences seasonal spikes in login attempts. They want to use predictive analytics to forecast the expected volume of authentication events so that they can distinguish a genuine surge from an attack. Which data science technique is most appropriate?

   • AUse a regression model to predict the exact IP address of the next attacker.
   • BUse a clustering algorithm to group login events by hour of day and alert on any hour that has more events than the previous day.
   • CUse time-series forecasting on historical authentication event counts to predict expected volumes, then alert when observed counts deviate significantly from the forecast.
   • DUse a classification model to label each login event as 'normal' or 'attack' based on the user's role.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university's Splunk deployment monitors student and faculty access to a research database. The security team wants to detect compromised accounts by identifying when a user accesses data at unusual times or from unusual locations. They have six months of historical authentication and access logs. Which behavioral analysis approach should they use to establish a baseline?

   • AUse a classification model trained on the six months of data to label each access event as 'good' or 'bad' without any feature engineering.
   • BApply a regression model to predict the next login time for each user and alert if the actual login time differs by more than 30 minutes.
   • CBuild a per-user profile of typical access times, locations, and data volumes, then flag deviations from that profile as potential compromises.
   • DCreate a single global baseline for all users and flag any access that occurs outside the most common hours.
   Reveal Solution Discussion Select an answer first