Justin has just finished successfully importing data from the CMDB platform into the SIEM. While validating data, he discovers a host with a MAC address (35:33:33:20:76) that does not have the same OUI (03:83:71) as the rest of the deployed devices. Which of the following is the most likely explanation for this discrepancy?

• A.CMDB contains data from personal devices managed under MDM
• B.CMDB data was normalized during the SIEM import process
• C.CMDB data was corrupted during the export process
• D.CMDB contains data related to dynamic VPN pool addresses

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the most direct way to measure a detection engineering practice to understand what gaps may exist in security controls and program effectiveness?

• A.Measure Mean Time to Detect (MTTD) threats.
• B.Measure the number of true positive security alerts created per environment.
• C.Measure security control coverage against industry frameworks and organizational risks.
• D.Measure the number of detections created per quarter.

Comment: *

Name: *

Email: *

Verification: *

Which Splunk feature allows querying data that resides in a separate, remote Splunk deployment without duplicating ingestion?

• A.Data model acceleration
• B.Federated Search
• C.Index replication
• D.Forwarder chaining

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the first step in developing an effective integration strategy for diverse security data sources in a security operations center (SOC)?

• A.Begin collecting available logs from all systems.
• B.Evaluate security information and event management (SIEM) systems.
• C.Hire a team of data engineers to manage the integrations.
• D.Define the security use cases and operational requirements that the data will support.

Comment: *

Name: *

Email: *

Verification: *

Which of the following are valid use cases for the MLTK (Machine Learning Toolkit) in a security context? (Choose all that apply.)

• A.Anomaly detection on network traffic volume
• B.Predicting future login failure trends
• C.Automatically writing SPL search queries
• D.Clustering similar security events for triage

Comment: *

Name: *

Email: *

Verification: *