A new security process should first be designed so that it satisfies the organization ' s governance, regulatory, policy, and compliance obligations . Among the available choices, this makes ensuring alignment with compliance requirements the strongest priority.
Security processes should establish repeatable controls, responsibilities, escalation paths, evidence requirements, and measurable outcomes. Compliance alignment helps ensure that required activities-such as access reviews, incident handling, audit logging, retention, vulnerability management, and reporting-are performed consistently and can be demonstrated during an assessment or audit. The broader course material similarly emphasizes contextual business requirements, standardized operating procedures, security-program measurement, and documented response workflows.
Integrating with legacy systems may be necessary, but architecture compatibility is subordinate to the process
' s security and governance objectives. Automating all workflows is also inappropriate: automation should be applied selectively where actions are deterministic, safe, and governed by appropriate controls. Reducing headcount is not a security-process design objective and can actually weaken operational resilience if treated as the primary goal.
The supplied PDF does not contain this exact stem, but its process-development themes support governance- driven, standardized security operations.
Study Guide topics: security process design, governance, compliance, SOPs, control effectiveness, program maturity.

The correlation search is scheduled to run every 2 minutes (*/2 * * * *) but is querying a 60-minute window (earliest = -60m@m). This large mismatch between the time range and the execution frequency is considered an improper configuration for ES correlation searches.
Such a configuration can lead to inconsistent detection behavior, including missed or duplicate findings, because the search continually reprocesses a very large window using a very short execution interval.

The log shows repeated DNS query failures (SERVFAIL) to a suspicious domain (reallybad.c2.com). The correct detection to create is Excessive DNS Failures, which alerts on abnormal patterns of failed DNS lookups that may indicate command-and-control or malware activity.

The Enterprise Security threat-intelligence lookup associated with file-based intelligence is file_intel .
Splunk Enterprise Security organizes threat-intelligence indicators according to observable type. This allows the Threat Intelligence Framework to normalize and match compatible indicators against event telemetry. File- oriented intelligence can contain characteristics such as file hashes, file names, or other file-related observables used to identify known malicious artifacts.
The naming convention is important. file_hash describes a type of file indicator but is not the threat- intelligence lookup name requested by the question. user_intel and user_hash concern user-oriented naming and do not correspond to the file intelligence collection.
The supplied study material demonstrates the same Threat Intelligence Framework design by asking which intelligence KV store contains malicious FQDNs, reinforcing that ES separates intelligence into purpose- specific collections such as service_intel. The exact file_intel question is not shown verbatim in the uploaded
60-question set, but the collection naming and threat-intelligence architecture are consistent with the framework tested there.
Study Guide topics: Threat Intelligence Framework, file_intel, file indicators, IOC normalization, threat matching, KV Store intelligence collections.

The four supported lookup types in Splunk are:
1. CSV - static lookups from comma-separated files.
2. External - scripts or commands that return lookup results dynamically.
3. Geospatial - for mapping geographic data.
4. KV Store - lookups backed by Splunk's key-value store for dynamic, structured data.