Perform Effective Data Review and Analysis. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A Splunk admin is integrating a new data source: firewall logs from a vendor that sends logs via syslog. The admin has configured the input, but the events show the `src_ip` field as the firewall's management IP for all events, and the `bytes` field is sometimes negative. The admin needs to determine whether the data is usable for security analysis. Which action should the admin take FIRST?

   • AVerify the sourcetype and index configuration, then compare a sample of events against the firewall's own logs to confirm the field extraction is correct.
   • BContact the vendor to request a new log format that includes the correct source IP.
   • CUse the `rex` command to extract the correct `src_ip` from the raw event.
   • DCreate a data quality dashboard that shows the percentage of negative `bytes` values.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst has correlated VPN logs with Active Directory account lockout events and found that a single user account was locked out 20 times in 10 minutes from different source IPs. What is the most actionable conclusion the analyst can draw?

   • AThe user has a forgotten password and is trying to log in from multiple devices.
   • BThe user is a threat actor and should be immediately terminated.
   • CThe user is likely a victim of a brute-force attack, and the account should be temporarily disabled.
   • DThe VPN is misconfigured and causing authentication failures.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A Splunk analyst is investigating a security incident and needs to analyze a large volume of network logs. The analyst wants to focus on traffic to a specific external IP address, but the logs contain many fields and the search is slow. Which approach best reduces the data volume and improves search performance?

   • AUse the `rex` command to extract the IP address from the raw event and then filter.
   • BUse a base search with the specific IP address as a keyword, and then use the `fields` command to limit the output to relevant fields.
   • CUse the `where` command to filter the IP address after loading all events.
   • DUse the `head` command to limit the number of events to the first 1000 and then filter.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the main purpose of data visualization in Splunk?

   • ATo communicate analysis results clearly and support decision-making
   • BTo automatically secure the data being visualized
   • CTo store data more efficiently
   • DTo replace the need for raw data searches
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A Splunk analyst needs to present a security dashboard to executives. The dashboard should show the trend of malware detections over the past 30 days and highlight the top 3 malware families. Which visualization approach best meets this requirement?

   • AA single pie chart showing the proportion of detections by malware family.
   • BA timechart showing the count of detections over time, with a separate table showing the top 3 malware families.
   • CA single-value visualization showing the total number of detections.
   • DA single column chart showing the count of detections by day.
   Reveal Solution Discussion Select an answer first