Splunk Certified Cybersecurity Defense Architect - SPLK-5003 Exam Practice Test

Which of the following are valid considerations when prioritizing data source onboarding for a SIEM? (Choose all that apply.)

What is a SBOM?

A security architect is tasked with implementing new security controls in a cloud environment. To minimize operational risk, the architect decides to use a phase-based rollout strategy.
The approach involves the following steps:
- Deploy the controls in "monitoring-only" mode on a canary system to observe for any unexpected behavior.
- Expand the monitoring deployment to a small subset of production systems.
- After validating the results and ensuring minimal impact, gradually enable the controls in blocking/enforcement mode, first on the canary, then the subset, and finally on all systems.
Which of the following best describes the main advantage of this phased, monitoring-first deployment strategy?

Buttercup Games' incident response team has found IOC's related to the "Water Curse" campaign within their dev environment. Suspicious activity shows unauthorized access to developer workstations and potential manipulation to their source code in their version control software, GitLow. Given "Water Curse's" known weaponization of open-source dependencies, a forensic investigation is required to determine the breach's full scope, identify affected systems, and collect evidence. To support a forensic investigation into the "Water Curse" compromise at Buttercup Games, what triage steps should be performed? (Choose all that apply.)

A cybersecurity team is looking to leverage DevSecOps best practices. They want to test new security policies with a small subset of users while monitoring for unusual access patterns or failures. Which of the following techniques will support this? (Choose all that apply.)

The cybersecurity team at a logistics management company plans to partner with their software engineering practice in a "shift-left" approach to secure the software development life cycle (SDLC). What improvement might the team recommend to facilitate early detection of software vulnerabilities?

How should the control network be separated from other networks in a water treatment plant?

Which of the following are components of the Splunk ES Asset and Identity framework? (Choose all that apply.)

Ahmed was recently hired as a security architect. He wants to measure how well his new organization is covering threat actor tactics like establishing persistence and escalating privileges.
What step should Ahmed take first?

Which of the following tasks takes the largest portion of a data scientist's time?

An architect notices that summary indexing jobs for a key detection are consistently running long and delaying alert generation. What is the most likely first step to diagnose the issue?

Sebastian is an incident responder encountering friction when coordinating and communicating with business units outside of his organization on large-scale incidents. What should he ensure is in place first to enable more seamless incident communications in the future?

What are the benefits of having data in a normalized schema? (Choose all that apply.)