A Cybersecurity Defense Architect must design log ingestion for a cloud-native environment using AWS. Which combination is most appropriate for near real-time ingestion of CloudTrail logs?

• A.Manual CSV export and periodic upload
• B.Splunk Add-on for AWS with SQS-based S3 ingestion
• C.Universal forwarder installed on EC2 only
• D.Syslog relay from CloudTrail

Comment: *

Name: *

Email: *

Verification: *

How can a threat intelligence team discover additional Indicators Of Compromise (IOCs) from threat actor payloads?

• A.Submit the payload to Splunk Intelligence Management.
• B.Submit the payload to Mission Control.
• C.Submit the payload to Behavioral Analytics.
• D.Submit the payload to Splunk Attack Analyzer.

Comment: *

Name: *

Email: *

Verification: *

Sebastian is an incident responder encountering friction when coordinating and communicating with business units outside of his organization on large-scale incidents. What should he ensure is in place first to enable more seamless incident communications in the future?

• A.Defined urgency and priority standards purpose-built to drive escalations with external business units.
• B.Decentralized incident commander function where all incident information is stored.
• C.Broad data classification standards to enabling sharing of incident details without restriction.
• D.Establish a formal incident communication plan, including points of contact per business unit.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is a key benefit of including machine learning as part of an organization's security detection capabilities?

• A.Performing anomaly detection against large datasets
• B.Archiving log events after they have been analyzed
• C.Writing detections to predict security events across multiple log sources
• D.Analyzing encrypted data without access to decryption keys

Comment: *

Name: *

Email: *

Verification: *

In a DevSecOps workflow, what is the primary purpose of an automated security gate that detects critical vulnerabilities during a build or deployment?

• A.To provide developers with optional warnings about potential security risks without affecting the build or deployment process.
• B.To replace manual security audits and eliminate the need for developer security training.
• C.To accelerate the software release cycle by bypassing security checks for minor issues.
• D.To ensure that only code meeting defined security standards is deployed to production, automatically failing the build or deployment if critical issues are found.

Comment: *

Name: *

Email: *

Verification: *