Which of the following statements about Splunk Enterprise Security content updates (ESCU) is accurate?

• A.ESCU is a fully manual process requiring custom detections to be written from scratch
• B.ESCU provides pre-built, regularly updated detection content mapped to threats and MITRE ATT&CK that architects can adopt and customize
• C.ESCU replaces the need for a SIEM entirely
• D.ESCU only applies to network traffic data

Comment: *

Name: *

Email: *

Verification: *

Sophia manages data ingestion for her organization's SIEM. The data science team wants to perform real-time analytics on security data and asks Sophia for a copy of all new endpoint telemetry from the current point forward. The SIEM currently collects 15TB of endpoint telemetry every day. Which of the following solutions can Sophia use to best help the data science team?

• A.Export the last 12 months of telemetry data from the SIEM in OCSF.
• B.Use a message bus to send data to both the SIEM and data science team.
• C.Export the last 12 months of telemetry data from the SIEM in JSON format.
• D.Configure the SIEM to export a CSV report of all new telemetry data every night.

Comment: *

Name: *

Email: *

Verification: *

A critical legacy application server runs on an unsupported OS and IT cannot install a security agent or forward logs on this server. This application processes sensitive data. What is the best strategy to continuously monitor the server's activities?

• A.Analyze network traffic via a tap.
• B.Disconnect the application from the network.
• C.Copy and review the access logs on a scheduled basis.
• D.Install MCP Security Monitoring.

Comment: *

Name: *

Email: *

Verification: *

A Defense Architect is asked to design detections for insider threat scenarios involving data exfiltration. Which combination of data sources would provide the most comprehensive coverage?

• A.DNS logs only
• B.DLP logs, proxy/web logs, and endpoint file access logs
• C.Firewall logs only
• D.Print server logs only

Comment: *

Name: *

Email: *

Verification: *

Which security tool should be implemented as a control during the code check-in and commit process to scan code for vulnerabilities?

• A.Style and Development Guide
• B.Dynamic Application Security Tool
• C.Code Enforcement Management Software
• D.Static Application Security Tool

Comment: *

Name: *

Email: *

Verification: *