Implement Security Analytics Strategies Beyond Traditional SIEM Such as Advanced Techniques Like Data Science, Machine Learning, Behavioral Analysis, and AI. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Splunk architect is designing a system to detect data exfiltration via DNS tunneling. The security team has observed that DNS tunneling often involves queries with high entropy subdomains and a high volume of requests. The architect has access to DNS logs and wants to use statistical modeling to detect this behavior. However, the environment also has legitimate dynamic DNS services that generate high-entropy subdomains. Which approach best distinguishes malicious tunneling from legitimate dynamic DNS?

   • AModel the ratio of query volume to response size for each domain, and flag domains where the query volume is high but the response size is consistently small, which is characteristic of tunneling.
   • BFlag any domain with a subdomain entropy above a fixed threshold, regardless of other factors.
   • CAlert on any domain that has more than 100 queries in a 10-minute window, without considering response size.
   • DUse a classification model trained on known tunneling and benign DNS data, but only use the subdomain entropy as the single feature.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How can machine learning models be integrated into a SIEM platform to enhance security analytics?

   • ABy using them to analyze historical data and generate risk scores that feed into SIEM alerts
   • BBy configuring the SIEM to block all traffic that does not match a known pattern
   • CBy replacing the SIEM's data storage with a machine learning database
   • DBy using ML to encrypt all SIEM data at rest
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which machine learning algorithm type is best suited for grouping similar security events into clusters to identify previously unknown attack patterns?

   • ARegression (supervised learning)
   • BReinforcement learning
   • CClassification (supervised learning)
   • DClustering (unsupervised learning)
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a common approach to incorporate behavioral analysis into a SIEM platform?

   • AConfiguring SIEM to automatically block users who fail to authenticate three times
   • BUsing SIEM to store all user passwords in an encrypted format
   • CCreating baselines of user and entity behavior and using SIEM correlation rules to alert on deviations
   • DReplacing the SIEM's log management with a user activity monitoring tool
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Splunk architect is asked to improve the detection of a new malware variant that communicates with command-and-control (C2) servers using short, periodic beaconing intervals. The existing correlation rules only look for a fixed number of connections to a known bad IP address. The architect wants to use statistical modeling to detect the beaconing pattern without relying on a static list of C2 IPs. Which approach is most appropriate?

   • AModel the time intervals between outbound connections from each host and flag hosts whose connection intervals show a regular, repeating pattern consistent with beaconing.
   • BIncrease the threshold of the existing rule to require 100 connections to the same IP before alerting.
   • CApply a clustering algorithm to group all outbound connections by destination port and alert on any port that appears more than 10 times.
   • DUse a regression model to predict the total number of outbound connections a host will make in a day, and alert if the count exceeds a global average.
   Reveal Solution Discussion Select an answer first