SPLK-5003試験無料問題集（165題）「Splunk Certified Cybersecurity Defense Architect 認定」

出題：1

How does a highly segmented network architecture impact security orchestration capabilities?
(Choose all that apply.)

A. Depends heavily on automation broker to perform automation.

B. Reduces points of failure.

C. Constrains security orchestration integrations because of complex firewall rules.

D. Simplifies API and service accessibility.

正解：A,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

A global enterprise is experiencing severe performance issues on their Splunk Enterprise Security Search Head due to an overwhelming number of distinct Asset and Identity lookups being performed simultaneously. What is the BEST architectural recommendation to resolve this performance issue?

A. Ensure that Asset and Identity lookups are properly merged and consolidated, and configure the framework to use KV Store rather than standard CSVs for large datasets.

B. Increase the index-time extraction limits on the Heavy Forwarders.

C. Enable Asset and Identity resolution at index time instead of search time.

D. Disable the Asset and Identity framework entirely.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

A threat hunter is looking for suspicious login activity across multiple different authentication systems and cloud providers. Today, the threat hunter has to query multiple different data sources with unique logic to gather basic information about authentication events. What method provides a simple way to standardize data formats, and look for common activity across different sources?

A. Calculated fields

B. Data normalization

C. Risk-based alerting

D. Adaptive Response Actions

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Which Splunk ES content type allows analysts to visually track the status of a security control or process, such as incident response stages?

A. Correlation search

B. Glass table

C. Investigation timeline

D. Data model

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Kevin is a SOC analyst working with the SRE team to investigate a report of slow responses from a customer-facing web application. While looking at load balancer and WAF logs, Kevin has discovered that one of the web servers hosting the application has gone offline. He does not see any alerts in the WAF or from the endpoint detection and response agent running on the web server. As part of triaging this incident, what should they do next? (Choose all that apply.)

A. Review system logs collected from the server to identify who last logged into it.

B. Change the WAF from blocking mode to alert-only mode.

C. Review recently scheduled requests in the company's change management system that may affect the same server.

D. Provision a new server behind the load balancer to return the application to full service.

正解：A,C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

Which of the following commonly requested metrics are poor indicators of a security program's effectiveness? (Choose all that apply.)

A. Number of alerts generated in a given time period

B. Number of attacks blocked

C. Unique hosts with viruses detected

D. Mean time to detect and respond

正解：A,B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

The growing rate of cyber attacks has led many countries to adopt laws and regulations pertaining to the collection, handling, and security of their citizens' private information regardless of where it is stored. Which of the following terms best describes these laws?

A. Data sovereignty

B. Data providence

C. Data residency

D. Data shielding

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：8

An architecture review reveals that sensitive HR data and SOC security logs are being stored in the same Splunk index, posing a risk of unauthorized access. What is the BEST approach to enforce strict least-privilege data access?

A. Mask the HR data at search time using standard regular expressions so that SOC analysts cannot read it.

B. Encrypt the HR data before it leaves the forwarder and refuse to give anyone the decryption key.

C. Create a Splunk dashboard that only displays SOC data and instruct analysts to only use that dashboard.

D. Separate the HR data and SOC logs into different indexes and use Role-Based Access Control (RBAC) to restrict access to the HR index.

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

An architect is designing SOAR (Splunk SOAR) playbooks for phishing response. Which action should typically occur first in the playbook logic?

A. Automatically delete the reported email from all mailboxes

B. Notify the CISO

C. Enrich indicators (URLs, attachments, sender) via threat intelligence lookups

D. Isolate the reporting user's endpoint

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

A cybersecurity team is looking to leverage DevSecOps best practices. They want to test new security policies with a small subset of users while monitoring for unusual access patterns or failures. Which of the following techniques will support this? (Choose all that apply.)

A. Infrastructure-as-Code

B. Canary Releases

C. Blue-Green Deployments

D. Automated Rollbacks

正解：B,D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：11

Which stage in the DevOps CI/CD pipeline is the most effective to generate an SBOM?

A. During the build phase to capture all the dependencies as they are assembled

B. During the UAT phase to capture any inconsistencies

C. During the requirements gathering phase to ensure legal is involved early on in the process

D. When the application is pushed into production

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：12

A Cybersecurity Defense Architect is asked to reduce the mean time to detect (MTTD) for credential stuffing attacks. Which data source is most critical to onboard first?

A. DHCP lease logs

B. Authentication logs from identity providers

C. DNS query logs

D. Print server logs

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

SPLK-5003試験無料問題集「Splunk Certified Cybersecurity Defense Architect 認定」