2.16 Describe the Concepts of Security Data Management 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is required to retain security logs for five years for compliance, but storage costs are a concern. The logs are currently stored in a SIEM with hot storage. The team wants to reduce costs without losing the ability to retrieve logs for audits. Which approach is most effective?

   • ADelete logs older than one year to reduce storage costs.
   • BArchive logs to compressed cold storage after a defined period and keep them for five years.
   • CKeep all logs in hot storage for five years.
   • DStore logs in an uncompressed format to preserve original data.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SIEM administrator is integrating a new log source that uses a proprietary format. The existing SIEM uses a common information model (CIM) for all logs. The administrator needs to ensure that the new logs can be correlated with existing logs. What is the most important step?

   • AStore the proprietary logs in a separate index to avoid conflicts
   • BDisable correlation rules until the new source is fully integrated
   • CIncrease the SIEM's storage capacity to handle the new logs
   • DWrite a parser or transformation to map the proprietary fields to the CIM fields
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A global company is subject to GDPR and stores security logs in a SIEM. The logs include personal data of EU data subjects. The company's security team wants to retain logs for five years for threat hunting, but the legal team says GDPR requires that personal data not be kept longer than necessary. The company decides to implement a data minimization approach. What should they do?

   • AAnonymize or pseudonymize personal data in logs after a shorter retention period, then retain the anonymized logs for five years
   • BDelete all logs after one year to comply with GDPR
   • CStore logs in a region outside the EU to avoid GDPR
   • DRetain all logs for five years and argue that security overrides GDPR
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which security data source is most useful for identifying the volume of traffic between two internal hosts over a specific time period?

   • ANetwork flow records
   • BIntrusion detection alerts
   • CVulnerability scan results
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team needs to collect authentication logs from 500 Windows servers and 200 Linux servers. The team wants to minimize the number of agents deployed and prefers to use a protocol already supported by the servers. The SIEM platform can receive logs over syslog. Which approach should the team use?

   • AUse packet capture on the network to reconstruct authentication events from server traffic.
   • BConfigure Windows Event Forwarding to a central collector that sends syslog to the SIEM, and configure Linux servers to send syslog directly.
   • CInstall a syslog agent on each server to forward logs to the SIEM.
   • DEnable SNMP traps on all servers and configure the SIEM to receive SNMP traps.
   Reveal Solution Discussion Select an answer first