Build and Populate Dashboards for Program Analytics. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A security operations manager asks you to build a dashboard for executives that shows the overall health of the security program. The executives want to see at a glance whether the program is meeting its key performance indicators (KPIs), such as mean time to detect (MTTD) and mean time to respond (MTTR), without needing to interpret complex charts. Which dashboard design approach best meets this requirement?

   • ABuild a dashboard with multiple dropdown filters for every data source so executives can drill into any metric they want.
   • BPresent a large heat map of all security events by source IP to show where activity is concentrated.
   • CCreate a dashboard with a single table showing all raw incident records and their timestamps so executives can review the details.
   • DUse single value panels for each KPI with color thresholds (e.g., green/yellow/red) and a trend line chart for MTTD and MTTR over time.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You are creating a new dashboard in Splunk for the SOC team to monitor daily incident volumes. The team wants to see the number of incidents by severity, a list of the top 10 affected assets, and the ability to filter by business unit. You have already identified the correct index and time range. What is the most efficient way to build this dashboard in the Splunk UI?

   • ACreate the dashboard, add three panels, and write a separate search for each panel, then add a dropdown input for business unit that feeds a token used by all three searches.
   • BUse a single search with a stats command that outputs all three visualizations in one table, then display that table as the only panel.
   • CCreate three separate dashboards and link them together with drilldowns so each panel is on its own page.
   • DCreate a single search that returns all incident fields, then use the dashboard editor to split that one result set into three panels.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   When should a dashboard be retired?

   • AWhen it is viewed frequently by users
   • BWhen it contains more than five panels
   • CWhen it has been in use for more than one year
   • DWhen it no longer supports current program analytics requirements
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are building a dashboard with a panel that shows the top 10 source IPs generating security events. You want users to be able to click on a source IP to see all events from that IP in a separate panel. Which feature should you use?

   • ACreate a separate dashboard for each IP and link to it via drilldown.
   • BAdd a drilldown to the top IPs panel that sets a token to the clicked IP, and configure the second panel's search to use that token.
   • CAdd a drilldown that opens a new search window with the IP pre-filled.
   • DUse a static text input where users manually type the IP address.
   Reveal Solution Discussion Select an answer first