Understand and Apply Splunk Methods of Data Normalization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which CIM data model would be most appropriate for normalizing events that record user login attempts and outcomes?

   • AEndpoint
   • BChange Analysis
   • CNetwork Traffic
   • DAuthentication
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When the CIM Validation tool reports that an event is non-compliant, what is the most likely cause?

   • AThe event contains too many fields and exceeds the indexer's field limit
   • BThe event is missing a required tag or field for the data model it should belong to
   • CThe event's timestamp is outside the search time range
   • DThe event is encrypted and cannot be read by the tool
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After configuring CIM normalization for a new data source, an analyst runs the CIM Validation tool and sees that events are tagged correctly but several required fields are missing. The validation report shows that the `user` field is empty for many events, even though the raw events contain a `username` field. What is the most likely cause and the appropriate fix?

   • AThe raw events need to be re-ingested with a different sourcetype to match the CIM field names.
   • BThe `username` field is not aliased to `user`; add a field alias in props.conf and transforms.conf.
   • CThe events are missing the `authentication` tag; add the tag to the sourcetype.
   • DThe CIM data model is not enabled; enable the Authentication data model in the CIM add-on.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team ingests proxy logs and wants them to appear in the Web data model. The logs contain fields like `client_ip`, `url`, and `status_code`. The team has already created aliases mapping `client_ip` to `src` and `url` to `url`. However, the Web data model is still not populating with these events. What is the most likely missing configuration?

   • AThe events are missing the `web` tag; add it to the sourcetype in props.conf.
   • BThe `status_code` field needs to be aliased to `status` for the data model to recognize it.
   • CA lookup must be created to map proxy log fields to the Web data model fields.
   • DThe proxy logs need to be re-ingested with a different sourcetype that matches the Web data model.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Splunk configuration technique allows a raw event field like 'Source_IP' to be searched using the CIM-standard field name 'src_ip'?

   • AField alias
   • BCalculated field
   • CEvent type
   • DLookup definition
   Reveal Solution Discussion Select an answer first