Understand and Apply Splunk Methods of Data Normalization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which technique would you use to create a new CIM-compliant field that combines two raw fields, such as creating 'src_ip' from 'client_ip' and 'source_address' when one or the other is present?

   • ALookup definition
   • BField alias
   • CCalculated field
   • DTag
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization ingests Windows Security Event logs (Event ID 4624 for successful logons) and sudo logs from Linux servers. The team wants both sources to populate the Authentication data model so that the `user`, `src`, and `action` fields are normalized. The Windows events already have `user` and `src` mapped via aliases, but the Linux sudo events do not have the required CIM tags. What must the team do to ensure the Linux events are properly categorized in the Authentication data model?

   • AChange the Linux sudo logs to be ingested as Windows Event Logs so they inherit the same tags.
   • BAdd a lookup table that maps Linux usernames to Windows usernames for the sudo sourcetype.
   • CAdd event tags `authentication` and `success` to the Linux sudo sourcetype in props.conf.
   • DCreate a calculated field named `action` that extracts the sudo command result for the Linux sourcetype.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the recommended way to add an organization-specific field to a CIM data model without breaking normalization standards?

   • AAdd the custom field to the data model's dataset definition in the CIM add-on
   • BCreate a completely new data model that does not use any CIM fields
   • CModify the core CIM data model files to replace standard fields with custom ones
   • DUse a lookup to map all custom fields to a single generic field
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team ingests firewall logs where the source IP field is named `src_ip` and the destination IP is `dst_ip`. They also ingest VPN logs where the same fields are named `SourceAddress` and `DestAddress`. The team wants both datasets to populate the `src` and `dest` fields in the Network Traffic CIM data model so that a single correlation search can work across both sources. The team must avoid modifying the raw data. Which configuration should the team apply?

   • ACreate field aliases mapping `src_ip` and `SourceAddress` to `src`, and `dst_ip` and `DestAddress` to `dest` in props.conf and transforms.conf.
   • BCreate a lookup definition that maps `src_ip` to `src` and `SourceAddress` to `src` and attach it to both sourcetypes.
   • CUse calculated fields in props.conf to rename `src_ip` to `src` and `dst_ip` to `dest` for each sourcetype.
   • DApply event tagging with `network` and `communicate` tags to both sourcetypes so the CIM data model recognizes the fields automatically.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security engineer is validating CIM compliance for a new endpoint data source. The CIM Validation tool reports that events are tagged with `endpoint` but the `user` field is missing. The raw events contain a `username` field. The engineer adds a field alias mapping `username` to `user`. After refreshing the data model, the validation still shows `user` as missing. What is the most likely reason?

   • AThe CIM Validation tool requires a calculated field instead of an alias for `user`.
   • BThe alias was added to the wrong sourcetype or the transforms.conf entry is not referenced in props.conf.
   • CThe data model needs to be re-created from scratch to pick up the new alias.
   • DThe events need to be re-tagged with the `endpoint` tag after the alias is added.
   Reveal Solution Discussion Select an answer first