CCSP SIEM Ingestion Practice Question
A security analyst is configuring a SIEM solution and wants to ingest security findings from a cloud provider's security findings service into Splunk. What is the most efficient method?
⚠ Common exam trap
The trap is that many candidates assume S3-based export (Option C) is the most reliable method, but it introduces latency and requires additional polling, whereas a Lambda push is more efficient for real-time security operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.
A serverless function can directly invoke the findings service API to retrieve findings and forward them to Splunk's HTTP Event Collector (HEC) in near real-time, avoiding intermediate storage or batch processing. This approach minimizes latency and operational overhead, making it the most efficient method for continuous ingestion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable cross-region aggregation of findings, then export to a CSV file.
Why it's wrong here
Incorrect. Exporting to CSV introduces manual steps and batch processing, leading to latency and inefficiency for continuous SIEM ingestion.
- ✓
Use a serverless function to pull findings from the findings service API and push to Splunk HTTP Event Collector.
Why this is correct
Correct. This method uses a serverless function to directly pull findings from the API and push them to Splunk in near real-time, minimizing latency and operational overhead.
- ✗
Configure the findings service to publish findings to a cloud storage bucket, then use Splunk to read from the bucket.
Why it's wrong here
Incorrect. Publishing to a storage bucket introduces a layer that requires Splunk to poll the storage, adding latency and complexity compared to direct push.
- ✗
Use a data catalog service to catalog findings data and connect to Splunk via JDBC.
Why it's wrong here
Incorrect. Data catalog services are not designed for real-time log ingestion; they are for data discovery and governance, making this approach inefficient.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.