Where should high value, low volume data be stored for searching (i.e. alerts generated by security tools)?

• A. In an SQL database
• B. In a file share
• C. In a highly compressed archive
• D. In a high speed query platform

A threat intelligence feed provides indicators with a "TLP:RED" designation. What is the appropriate handling within the organization?

• A. Restrict sharing/distribution strictly to named recipients within the organization
• B. Publish the indicators publicly for community benefit
• C. Ignore the TLP designation since it doesn't affect Splunk ingestion
• D. Freely share indicators with external partners

A SOC engineer has configured a data feed of firewall logs, however the log feed only contains the basic informational fields of timestamp, src_ip, src_port, dst_ip, dst_port, action, and protocol.
Which of the following reflects the best practice for an ideal enrichment strategy?

• A. Avoid integrating third-party threat intel during enrichment to reduce the complexity of the pipeline.
• B. Limit enrichment to external IPs only, as internal IPs are generally considered trusted and don't require additional enrichment.
• C. Enrich firewall logs from internal asset databases to add business context, role, and ownership of source and destination IPs.
• D. Enrich firewall logs only when they trigger alerts to conserve system resources.

Buttercup Games needs to provide its SOC team access to a wide range of security data sources located across different regions and cloud providers. Which architectural solution allows the SOC analysts to query these data sources as a single logical source without having to migrate or copy all the raw data?

• A. Federated search
• B. Message bus
• C. Centralized data warehouse
• D. Data mesh