Log Management and Correlation CSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial company must retain security logs for at least one year to meet regulatory requirements. The SIEM storage is expensive, and the team wants to keep the SIEM fast. What is the best approach?

   • ACompress logs and store them on the same SIEM storage for one year
   • BStore logs in the SIEM for 90 days, then archive them to low-cost object storage for the remainder of the year
   • CKeep all logs in the SIEM for one year to ensure they are immediately searchable
   • DDelete logs older than 90 days to save storage costs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A healthcare organization is subject to HIPAA, which requires retaining audit logs for six years. The SIEM has limited storage, and the team wants to keep the SIEM operational. What is the best approach?

   • AArchive logs older than 90 days to a low-cost storage solution and keep them retrievable
   • BDelete logs after one year to save storage
   • CCompress logs and keep them on the SIEM for six years
   • DStore all logs in the SIEM for six years to ensure compliance
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which correlation technique is most appropriate for detecting a multi-step attack such as a user downloading a malicious attachment and then executing it?

   • AThreshold-based correlation
   • BAnomaly-based correlation
   • CPattern-based correlation
   • DAggregation-based correlation
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC team is configuring a SIEM correlation engine to process logs from multiple sources in real time. They notice that the correlation engine is missing events because the input queue is full. What should they do first?

   • AReduce the log retention period to free up memory
   • BAdd more log sources to increase the data volume
   • CDisable all correlation rules to reduce the load
   • DIncrease the size of the input queue and tune the correlation rules to reduce unnecessary processing
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which scenario best illustrates the value of log correlation?

   • ACombining a user's failed login attempts, a subsequent successful login from a new location, and a data exfiltration event to identify a compromised account
   • BReviewing a single server's CPU usage logs to diagnose a performance issue
   • CA single firewall log showing a blocked port scan
   • DViewing a single antivirus alert for a malware detection
   Reveal Solution Discussion Select an answer first