Perform Effective Data Review and Analysis. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A security analyst is investigating a potential data exfiltration. The analyst has firewall logs showing outbound connections to an unusual external IP and DNS logs showing a query for a domain that resolves to that IP. Which Splunk search approach best correlates these two data sources to confirm the relationship?

   • ARun a search on the DNS logs only and infer the firewall activity from the domain resolution.
   • BUse a subsearch to find the external IP from DNS logs, then use that IP to filter firewall logs.
   • CCreate a lookup table that maps the external IP to the domain and then search both indexes with a join.
   • DSearch firewall logs for the external IP and DNS logs for the domain separately, then manually compare the timestamps.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which Splunk command is used to remove duplicate events from search results?

   • Ahead
   • Brare
   • Cdedup
   • Dtop
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In the context of a Splunk data review, what does 'verifying data integrity' primarily involve?

   • AEnsuring that dashboards are accessible to all team members.
   • BConfirming that all data sources are licensed correctly.
   • CDetermining which fields are extracted from raw events.
   • DChecking that data has not been altered or corrupted during ingestion.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A Splunk analyst needs to present a summary of authentication failures across multiple departments to non-technical management. The analyst wants to highlight which department has the highest failure rate. Which visualization best communicates this information?

   • AA column chart with departments on the x-axis and failure counts on the y-axis.
   • BA pie chart showing the proportion of total failures by department.
   • CA scatter plot with failure count on the y-axis and time on the x-axis.
   • DA single-value visualization showing the total number of failures across all departments.
   Reveal Solution Discussion Select an answer first