Perform Effective Data Review and Analysis. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A Splunk analyst is validating the accuracy of a new data source that ingests DHCP logs. The analyst wants to confirm that the number of events ingested matches the number of DHCP leases issued by the DHCP server. Which approach best validates the data?

   • ARun a search for all DHCP events and manually review a random sample for obvious errors.
   • BCheck the index size to ensure it is large enough to hold the expected data.
   • CCompare the count of events in Splunk for the DHCP sourcetype to the count of leases in the DHCP server's own logs for the same time period.
   • DCreate a dashboard that displays the number of DHCP events over time.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   An analyst sees a spike in failed login attempts from a single IP address. What is the most appropriate interpretation of this finding?

   • AIt is definitely a false positive and can be ignored
   • BIt proves that the account is compromised
   • CIt indicates that the user has forgotten their password
   • DIt may indicate a brute-force attack and should be investigated further
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   An analyst notices that the same event appears with different timestamps in two different indexes. Which data quality issue does this indicate?

   • ALack of timeliness
   • BInconsistency
   • CInaccuracy
   • DIncompleteness
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A Splunk analyst is assessing the quality of VPN authentication logs. The analyst notices that the `user` field is missing in 15% of events, and the `src_ip` field sometimes contains the string "unknown". The analyst wants to validate whether these issues affect the accuracy of a user-based access report. Which approach best validates the data quality?

   • AReplace all "unknown" values in `src_ip` with the VPN gateway's IP address to ensure consistency.
   • BCross-check a sample of events with missing `user` against the VPN appliance's own logs to see if the field is truly absent or just misparsed.
   • CIgnore the missing `user` fields because the report only needs successful authentication events.
   • DRun a search to count events with missing `user` and compare the count to the total events from the VPN source.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A Splunk admin is reviewing a new data source that ingests firewall logs. The admin notices that the `src_ip` field is sometimes empty and the `bytes_out` field contains negative values. The admin wants to document the data review process for this source. Which action should the admin take FIRST to ensure the review is systematic and reproducible?

   • ADelete all events with empty `src_ip` to clean the data before analysis.
   • BCreate a data quality report that lists the percentage of empty `src_ip` values and negative `bytes_out` values, and save it as a saved search.
   • CIdentify the data source, map its flow from ingestion to index, and verify the sourcetype and index configuration.
   • DImmediately create an alert to notify the team whenever `bytes_out` is negative.
   Reveal Solution Discussion Select an answer first