Local vs. Centralized Log Management SCE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A multinational company must comply with data residency regulations that require logs to remain within the country of origin. They also need to correlate security events across all regions. What is the best approach?

   • AEncrypt all logs before sending them to the global data center.
   • BUse local log management only and do not attempt any cross-region correlation.
   • CSend all logs to a single global data center located in one country.
   • DDeploy a centralized log management system in each region and aggregate only metadata to a global system.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a challenge of local log management?

   • AIt is difficult to correlate events across multiple systems
   • BIt provides a single point of failure
   • CIt requires complex configuration
   • DIt requires significant network bandwidth
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is expanding from 50 to 500 servers. Currently, they use local log management. The security team is concerned that local logs will not scale for incident investigations. What is the primary scalability issue with local log management?

   • ALocal logs cannot be encrypted.
   • BLocal logs consume too much disk space on each server.
   • CLocal logs are not compatible with modern operating systems.
   • DInvestigators must access each server individually to review logs, which is time-consuming and inefficient.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial institution must demonstrate to auditors that it can detect and investigate security incidents across its entire network. The institution has multiple offices and a mix of on-premises and cloud systems. Which approach best meets this requirement?

   • AKeep logs local to each system and only share them with auditors upon request.
   • BStore logs only for critical servers and ignore workstations.
   • CImplement a centralized log management solution that collects logs from all offices and cloud systems.
   • DUse a different log management tool for each office to maintain independence.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A small e-commerce company with 20 servers uses local log management. After a security incident, the incident responder must manually log into each server to collect logs. This process takes hours and some logs are missing because the attacker deleted them. Which comparison between local and centralized log management is most relevant here?

   • ALocal logs are always more secure because they are not transmitted over the network.
   • BCentralized logs require more bandwidth but are always tamper-proof.
   • CLocal logs are easier to correlate across systems because they are on the same machine.
   • DCentralized logs are easier to analyze and more resistant to tampering by an attacker.
   Reveal Solution Discussion Select an answer first