Implement Security Analytics Strategies Beyond Traditional SIEM Such as Advanced Techniques Like Data Science, Machine Learning, Behavioral Analysis, and AI. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   In an AI-driven security architecture, what is the primary benefit of using AI for decision-making in incident response?

   • AIt accelerates response times by quickly analyzing data and suggesting or executing appropriate actions
   • BIt completely eliminates the need for human oversight in all security operations
   • CIt ensures that all security alerts are false positives
   • DIt removes the requirement for security policies and procedures
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which method is commonly used to establish a baseline for entity behavior in security analytics?

   • ACollecting and analyzing historical activity data over a period of time to determine typical patterns
   • BApplying a static set of rules that define acceptable behavior for all users
   • CEncrypting all data at rest to prevent unauthorized access
   • DUsing a predefined list of known malicious IP addresses to block traffic
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Splunk architect is designing an analytics solution to detect data exfiltration. The organization has labeled historical data sets of confirmed exfiltration events and non-exfiltration events. The architect wants to build a model that can classify new network sessions as either 'exfiltration' or 'normal' based on features such as bytes transferred, session duration, and destination reputation. Which machine learning approach is most appropriate for this task?

   • AUse a time-series forecasting model to predict the next session's duration based on historical averages.
   • BUse a clustering algorithm to group sessions into two clusters and then manually label each cluster.
   • CUse a classification algorithm, such as logistic regression or random forest, trained on the labeled historical data to predict the class of new sessions.
   • DUse a regression algorithm to predict the exact number of bytes that will be transferred in a future session.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A Splunk architect is integrating a custom ML model into Splunk Enterprise Security. The model is trained in Python and produces a risk score for each user. The architect needs to make the risk score available for real-time correlation rules and dashboards. The model must be retrained weekly with new data. Which integration approach is most efficient and maintainable?

   • ARun the model in an external service and have it send alerts directly to the SOC's email, bypassing Splunk ES entirely.
   • BExport the model's risk scores to a CSV file daily and upload it to Splunk as a lookup table for correlation rules.
   • CUse the Splunk Machine Learning Toolkit (MLTK) to register the model, apply it at search time, and schedule a weekly retraining job that updates the model in MLTK.
   • DRewrite the model as a Splunk search command from scratch, without using MLTK, and manually update the code each week.
   Reveal Solution Discussion Select an answer first