The internet facing WAF for a new customer facing application has been identified as a potential telemetry collection point.Which of the following best describes this data prior to any tuning or curation efforts?
Answer(s): B
Internet-facing WAF telemetry is high value because it provides visibility into attacks, suspicious requests, exploit attempts, and traffic patterns targeting a customer-facing application. Before tuning or curation, it is also typically high noise because public-facing applications receive large volumes of benign traffic, automated scanning, false positives, and repetitive web requests.
An organization has decided to implement a new endpoint security product. The CISO has concerns about the rollout due to the nature of the varied endpoint builds and installed applications.After initial testing in lab has shown no issues, what next step should the architect perform to ensure the success of their rollout?
Answer(s): D
After lab testing, the architect should run a controlled pilot across representative endpoint groups. Testing with subsets of users from each major build and application profile helps identify compatibility, performance, and operational issues before broad deployment, improving rollout success while limiting risk.
Which of the following describes CIS controls?
Answer(s): C
CIS Controls are a prioritized set of security safeguards designed to help organizations defend against common and high-impact cyberattack vectors. They provide practical, prescriptive guidance for improving security posture across systems, networks, applications, and data.
Kevin, a security architect, is planning a long-term retention strategy for security logs (e.g.7+ years) for compliance and forensic purposes.Which storage solutions are cost-effective for this requirement and still allow future access? (Choose all that apply.)
Answer(s): A,B
Cloud object storage with infrequent access is cost-effective for long-term log retention because it supports durable, low-cost storage while preserving future retrieval capability. A SAN with cold storage tiers can also support long retention by moving rarely accessed security logs to lower-cost storage while keeping them available for compliance review or forensic investigation.
A critical legacy application server runs on an unsupported OS and IT cannot install a security agent or forward logs on this server. This application processes sensitive data.What is the best strategy to continuously monitor the server’s activities?
Answer(s): A
Analyzing network traffic through a tap provides continuous passive monitoring without requiring any agent or log forwarder on the unsupported legacy server. This allows the organization to observe communications, detect suspicious activity, and monitor access to the sensitive application while avoiding changes to the fragile host.
TighCo is a multi-national application delivery company that delivers content across the world to millions of users. The company requires all solutions are highly resilient and provide maximum uptime. They are looking to deploy a new security solution to help with authentication abuse. They have identified a solution that can meet their needs with a single appliance.How should they architect this solution?
For a multinational service requiring maximum uptime, the solution should be deployed in a resilient cloud architecture with auto scaling. This avoids dependence on a single appliance, supports availability across failures, and allows capacity to adjust as authentication traffic changes.
What is the most effective approach to ensure coordinated response and clear communication during a large-scale security incident?
A large-scale security incident requires centralized coordination, clear decision ownership, and structured communication. An incident commander function with predefined processes and communication channels ensures teams stay aligned, updates are consistent, and response actions are prioritized effectively.
Hannah is building a data lifecycle management strategy for her organization. She is evaluating data retention requirements such as how and when to delete or destroy data as part of that strategy.What factors must Hannah consider as part of defining data destruction requirements? (Choose all that apply.)
Answer(s): B,C
Data destruction requirements must account for both deletion obligations and retention obligations. Privacy and compliance rules may require data to be deleted when a valid customer request is received, while legal or regulatory requirements may require certain records to be retained for a defined minimum period before destruction is allowed.
Post your Comments and Discuss Splunk SPLK-5003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SPLK-5003 content, but please register or login to continue.