Local vs. Centralized Log Management SCE Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   A financial institution is required to detect insider threats. They have logs from email, file access, and authentication systems stored locally on each server. The security team needs to identify an employee who accesses sensitive files after hours and then attempts to log in from an unusual location. What is the most important reason to centralize these logs?

   • ATo eliminate the need for endpoint security software.
   • BTo reduce the storage space required for logs.
   • CTo correlate events across different systems to build a complete picture of the user's actions.
   • DTo make logs accessible only to the security team.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company uses local log management. After a security incident, they discover that the attacker deleted logs on several servers. The company wants to prevent this in the future. Which measure would be most effective while still using local log management?

   • AConfigure local logs to be append-only and store them on a separate partition with restricted access.
   • BStore local logs in a compressed format to save space.
   • CIncrease the verbosity of local logs to capture more detail.
   • DDisable local logging and rely on memory-based monitoring.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security operations center (SOC) is overwhelmed with alerts from multiple tools, each with its own logs. Analysts spend too much time manually correlating events. The SOC manager wants to improve efficiency. What is the most effective use of centralized log management?

   • AReduce the number of logs collected by disabling logging on non-critical systems.
   • BKeep logs in each tool and have analysts use multiple dashboards.
   • CHire more analysts to manually correlate logs.
   • DAggregate all logs into a single platform with automated correlation and alerting.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A healthcare organization must provide audit logs to regulators within 24 hours of a request. Logs are spread across 500 servers, each with local storage. The compliance team spends days collecting and correlating logs manually. What is the most effective solution?

   • AReduce the number of servers to simplify local log management.
   • BImplement centralized log management to aggregate logs and enable rapid search and retrieval.
   • CKeep logs local but create a manual checklist for collecting logs from each server.
   • DStore logs only on the compliance officer's laptop.
   Reveal Solution Discussion Select an answer first