Perform Effective Data Review and Analysis. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An analyst compares the count of events in Splunk to the count in the original log source. This is an example of which process?

   • AData validation
   • BData reduction
   • CData enrichment
   • DData visualization
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst has correlated firewall logs with threat intelligence and found that a specific internal host has been communicating with a known command-and-control server. The analyst has created a visualization showing the communication pattern over time. What is the most actionable conclusion the analyst can draw?

   • AThe firewall is misconfigured and allowing traffic to the C2 server.
   • BThe host is likely compromised and should be isolated for further investigation.
   • CThe host is performing a legitimate business function that happens to use the same IP.
   • DThe threat intelligence is outdated and the IP is no longer malicious.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of correlating data from multiple sources in cybersecurity defense?

   • ATo reduce the storage space required for logs
   • BTo replace the need for individual data source monitoring
   • CTo ensure that all data sources use the same format
   • DTo identify patterns and anomalies that are not visible in a single source
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Splunk analyst is assessing the quality of a new data source that ingests endpoint logs. The analyst finds that the `user` field is missing in 20% of events, and the `event_id` field sometimes contains non-numeric values. The analyst needs to decide whether to use this data for a user-based behavioral analysis. Which action should the analyst take to best assess the data quality?

   • AExclude events with missing `user` fields from the analysis and proceed.
   • BImmediately create a data quality dashboard to monitor these issues over time.
   • CCalculate the percentage of missing `user` fields and non-numeric `event_id` values, then compare these metrics against a baseline from a known-good source.
   • DUse the `rex` command to extract the `user` field from the raw event for all events.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of data enrichment in Splunk?

   • ATo remove unnecessary fields from events
   • BTo compress data to save storage space
   • CTo add context such as threat intelligence or asset information to raw data
   • DTo change the format of data to match a standard
   Reveal Solution Discussion Select an answer first