A security team ingests both firewall and proxy logs. The firewall logs are tagged with `network` and `communicate`, and the proxy logs are tagged with `web`. The team wants to run a search that uses the Network Traffic data model to analyze both firewall and proxy connections. The proxy logs have the required fields aliased. However, the Network Traffic data model only returns firewall events. What is the most likely cause?

The firewall logs need to be re-tagged with `web` to match the proxy logs.

The proxy logs need a calculated field to convert `url` to `dest` for the Network Traffic model.

The proxy logs are missing the `network` tag, which is required for the Network Traffic data model.

The Network Traffic data model needs to be extended to include the `web` tag.

A security team is ingesting DNS logs from multiple sources. Each source uses different field names for the query (e.g., `query`, `qname`, `domain`). The team wants to normalize these to the `query` field in the Network Resolution data model. They have already created field aliases. What is the next step to ensure the data model populates correctly?

Create a calculated field that concatenates all query fields into one `query` field.

Configure a lookup to map DNS query fields to the CIM field names.

Run the CIM Validation tool to confirm the aliases are working.

Ensure the events are tagged with the `network` tag (and `dns` if applicable) so the data model includes them.

An organization wants to track a custom field `risk_level` in their Endpoint data model. This field is populated by a threat intelligence feed and is not part of the standard CIM. The team wants to keep using the standard Endpoint data model for their existing dashboards. What is the best approach?

Create a new data model named `Endpoint_Custom` and move all endpoint events to it.

Extend the Endpoint data model by adding `risk_level` as a custom field and tag the relevant events with the `endpoint` tag.

Use a calculated field to map `risk_level` to an existing standard field like `severity`.

Add `risk_level` to the CIM add-on's global fields configuration.

What is the purpose of event tagging in the context of CIM normalization?

To permanently delete events that are not relevant to security

To add a timestamp to events that lack one

To assign a data model tag to events so they are recognized as belonging to a specific CIM data model

To compress events to reduce storage usage

SplunkCertified Cybersecurity Defense Engineer

Domain 1Objective 3

Understand and Apply Splunk Methods of Data Normalization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Part of the Data Engineering domain, which accounts for 10% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

10%of the exam

Questions 16–20

16expert · hard
A security team ingests both firewall and proxy logs. The firewall logs are tagged with `network` and `communicate`, and the proxy logs are tagged with `web`. The team wants to run a search that uses the Network Traffic data model to analyze both firewall and proxy connections. The proxy logs have the required fields aliased. However, the Network Traffic data model only returns firewall events. What is the most likely cause?
Select an answer first
17application · medium
A security team is ingesting DNS logs from multiple sources. Each source uses different field names for the query (e.g., `query`, `qname`, `domain`). The team wants to normalize these to the `query` field in the Network Resolution data model. They have already created field aliases. What is the next step to ensure the data model populates correctly?
Select an answer first
18application · medium
An organization wants to track a custom field `risk_level` in their Endpoint data model. This field is populated by a threat intelligence feed and is not part of the standard CIM. The team wants to keep using the standard Endpoint data model for their existing dashboards. What is the best approach?
Select an answer first
19foundation · easy
What is the purpose of event tagging in the context of CIM normalization?
Select an answer first
20foundation · easy
Which of the following is a standard field defined in the CIM Network Traffic data model?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.

Understand and Apply Splunk Methods of Data Normalization. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Questions 16–20

An organization wants to track a custom field `risk_level` in their Endpoint data model. This field is populated by a threat intelligence feed and is not part of the standard CIM. The team wants to keep using the standard Endpoint data model for their existing dashboards. What is the best approach?

What is the purpose of event tagging in the context of CIM normalization?

Which of the following is a standard field defined in the CIM Network Traffic data model?

Keep studying — Data Engineering