Local vs. Centralized Log Management SCE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has centralized log management, but the central log server is located in the same data center as the systems it monitors. A fire in the data center destroys both the systems and the logs. What is the best way to prevent this from happening again?

   • AIncrease the storage capacity of the central log server.
   • BKeep logs only on the original systems to avoid a single point of failure.
   • CReplicate logs to a secondary location in a different geographic region.
   • DUse a cloud-based log service that stores logs in the same region.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses local log management on all endpoints. During an investigation, the analyst finds that logs on one compromised workstation are missing, while logs on other workstations are intact. What is the most likely explanation for this discrepancy?

   • AThe workstation never generated any logs.
   • BThe attacker deleted logs on the compromised workstation, a known risk of local log storage.
   • CThe analyst forgot to check the correct folder.
   • DThe workstation's logs were automatically forwarded to a central server.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An auditor is reviewing a company that uses local log management on each server. The auditor asks how the company can prove that logs have not been altered. What is the main challenge the company faces?

   • ALocal logs are difficult to access because they are stored in a proprietary format.
   • BLocal logs are automatically deleted after 24 hours.
   • CLocal logs cannot be used for troubleshooting because they are incomplete.
   • DLocal logs are more susceptible to tampering because an attacker with system access can modify them.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A mid-sized company is deciding between local and centralized log management. They have 200 servers, a limited IT budget, and a compliance requirement to retain logs for one year. The security team wants to correlate events across servers, but the network team is concerned about bandwidth. What is the most balanced approach?

   • AKeep all logs local and manually collect them when needed for compliance.
   • BCentralize all logs without any filtering to ensure complete visibility.
   • CUse local logs only and rely on each server's built-in alerting.
   • DCentralize logs but filter and prioritize which logs are sent to reduce bandwidth and storage costs.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A multinational corporation with offices in 10 countries wants to detect cyber threats that span multiple regions. Each office currently manages logs locally. The security team wants to identify patterns like a user logging in from two different countries within minutes. What is the primary benefit of centralized log management that enables this detection?

   • AImproved visibility and correlation across all offices
   • BElimination of the need for local security controls
   • CReduced network bandwidth usage
   • DGuaranteed prevention of all cyber attacks
   Reveal Solution Discussion Select an answer first