Optimize Case Management. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of defining a case lifecycle in Splunk?

   • ATo enrich cases with threat intelligence
   • BTo automate the assignment of cases to analysts
   • CTo generate reports on case volume
   • DTo provide a structured path from case creation to closure
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the main benefit of automating case management workflows in Splunk?

   • AReplacing the need for analyst review
   • BReducing manual effort on repetitive tasks
   • CEliminating the need for case prioritization
   • DGuaranteeing all cases are closed automatically
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   During a major incident, multiple analysts are working on related cases. They are duplicating efforts by enriching the same IP addresses and running the same searches. The incident commander wants to improve collaboration and reduce redundant work. What is the most effective way to achieve this in Splunk SOAR?

   • AUse case linking and shared artifacts so that related cases can reference common data and avoid re-enrichment.
   • BCreate a single 'master' case and have all analysts work on it, adding their findings as notes.
   • CInstruct analysts to communicate via a separate chat channel and share findings there.
   • DHave each analyst create their own case for the IP they are investigating.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services firm requires that every case be assigned to a specific analyst within 15 minutes of creation. If no analyst is available, the case must be escalated to the team supervisor. The SOC manager wants to enforce this policy without relying on analysts to remember to claim cases. What should be configured in Splunk SOAR?

   • AA case status of 'Unassigned' that remains until an analyst manually changes it to 'Assigned'.
   • BA scheduled search that runs every hour and reports which cases are unassigned, so the supervisor can manually assign them.
   • CA playbook that runs on case creation, attempts to assign the case to the analyst with the fewest open cases, and escalates to the supervisor if assignment fails.
   • DAn email alert to all analysts whenever a new case is created, asking them to volunteer to take ownership.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which data source is commonly used to enrich a case in Splunk?

   • ACase ID
   • BCase status
   • CAnalyst name
   • DThreat intelligence feeds
   Reveal Solution Discussion Select an answer first