Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   Which of the following is an example of an action that can be configured to trigger when a notable event is generated?

   • ADeleting the raw log data associated with the event
   • BSending an email notification to the security team
   • CChanging the firewall rules to block all traffic
   • DAutomatically patching the affected system
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In Splunk Enterprise Security, what is the primary purpose of generating a notable event?

   • ATo replace all other search results in Splunk with a single unified view
   • BTo provide a structured, actionable alert that an analyst can review, investigate, and manage in Incident Review
   • CTo store raw log data in a more compressed format for long-term retention
   • DTo automatically remediate security incidents without human intervention
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A SOC analyst is reviewing notable events in the Incident Review interface. The analyst notices that several events have the status 'New' and are assigned to 'unassigned'. The team's workflow requires that all high-severity events be assigned to a senior analyst and set to 'In Progress' within 30 minutes of creation. Which action in the Incident Review interface should the analyst take to comply with this workflow?

   • AChange the correlation search to automatically set the status to 'In Progress' and assign the senior analyst as the owner.
   • BDelete the high-severity events and re-run the correlation search to generate new ones with the correct status and owner.
   • CSelect the high-severity events, change the status to 'In Progress', and assign them to the senior analyst using the 'Edit' or 'Update' options in the event details.
   • DCreate a new notable event for each high-severity event and assign it to the senior analyst.
   Reveal Solution Discussion Select an answer first