Implement Security Analytics Strategies Beyond Traditional SIEM Such as Advanced Techniques Like Data Science, Machine Learning, Behavioral Analysis, and AI. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security operations team manages a Splunk Enterprise deployment for a financial services firm. They have been using threshold-based correlation rules to detect insider threats, but the rules generate a high volume of false positives because legitimate users often work late during quarterly reporting periods. The team wants to reduce false positives while still detecting unusual after-hours access. Which approach should they implement?

   • AApply a machine learning clustering algorithm to group all users into a single 'normal' cluster and alert on any user who falls outside that cluster.
   • BCreate a baseline of each user's normal working hours and access patterns, then trigger alerts only when a user's activity deviates significantly from their own historical baseline.
   • CDisable the correlation rule during the quarterly reporting period to avoid false positives.
   • DIncrease the threshold for the existing correlation rule so that alerts only fire when a user accesses the system after midnight.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A large enterprise uses Splunk Enterprise Security (ES) to monitor millions of events per day. The SOC team is overwhelmed by the volume of low-severity alerts generated by correlation rules. They want to use AI to reduce alert fatigue and prioritize the most critical threats for human investigation. Which strategy aligns with AI-driven security operations?

   • AUse AI to generate new correlation rules automatically and deploy them to production without testing.
   • BConfigure the SIEM to automatically delete all alerts that the AI model scores below a medium confidence threshold.
   • CReplace all correlation rules with a single AI model that directly blocks network traffic without human oversight.
   • DImplement an AI model that scores and ranks incoming alerts based on risk, automatically escalating only the highest-priority alerts to the SOC queue.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Splunk architect is evaluating how to enhance a SIEM with behavioral analytics. The organization wants to detect lateral movement by identifying when a user's account authenticates to a new host for the first time. The architect has access to authentication logs and asset inventory data. Which approach best integrates behavioral analytics with the SIEM?

   • AUse a regression model to predict the number of hosts a user will access in a week and alert if the count exceeds 10.
   • BBuild a baseline of each user's historically accessed hosts, then create a correlation rule that triggers when an authentication event references a host not in that user's baseline.
   • CApply a clustering algorithm to all authentication events and alert on any event that is in a cluster with fewer than 5 events.
   • DUse a static list of 'high-value' hosts and alert on any authentication to those hosts from any user.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Splunk architect is integrating a machine learning model into Splunk Enterprise Security. The model is trained to detect anomalous DNS queries. The architect wants to ensure that the model's output is visible to analysts in the ES interface and can be used in correlation rules. Which integration approach should they use?

   • AUse Splunk Machine Learning Toolkit (MLTK) to run the model as a search-time operation, save the results to an index, and then create correlation rules that reference the model's output fields.
   • BDeploy the model as a custom Splunk app that only displays results in a standalone dashboard, with no connection to ES correlation rules.
   • CUse the model to directly modify the underlying raw events in the index, changing the source data to include a 'malicious' field.
   • DRun the model in an external Python script and email the results to the SOC team daily, bypassing Splunk entirely.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A security team wants to build a model that predicts whether a login attempt is legitimate or malicious based on historical login data that has been labeled as 'good' or 'bad'. Which machine learning approach should they use?

   • AClustering
   • BRegression
   • CDimensionality reduction
   • DClassification
   Reveal Solution Discussion Select an answer first