Local vs. Centralized Log Management SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is implementing centralized log management. They are concerned about the SIEM becoming a single point of failure and about the cost of storing large volumes of logs. Which solution best addresses both concerns?

   • AUse a cloud-based SIEM with automatic scaling and no local storage.
   • BDeploy a redundant SIEM cluster and implement log filtering and tiered storage.
   • CUse a single SIEM with unlimited storage to ensure no logs are lost.
   • DKeep logs only on the original systems and use a SIEM only for real-time alerts.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary characteristic of centralized log management?

   • ALogs from multiple systems are aggregated into a single repository
   • BLogs are only kept for a short time to save storage
   • CEach system stores its logs in its own local files
   • DLogs are sent to a third-party vendor for analysis
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network engineer is troubleshooting a router that is intermittently dropping packets. The router is in a remote branch with an unreliable WAN link. The engineer needs to see the router's logs immediately. What is the primary advantage of local log management in this situation?

   • ALogs are stored in a tamper-proof format.
   • BLogs are available on the device even when the network is down.
   • CLogs are automatically correlated with other devices.
   • DLogs are automatically backed up to the cloud.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which advantage is associated with local log management?

   • ASimplified setup because no central infrastructure is required
   • BEnhanced ability to detect attacks that span multiple systems
   • CLower storage requirements because logs are not retained
   • DReduced risk of log tampering
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company centralizes logs from 2,000 servers into a single SIEM. After a month, the SIEM is slow, and the network team reports high bandwidth usage during peak hours. Which two challenges of centralized log management are most directly illustrated?

   • ACompliance violations and data residency
   • BSingle point of failure and log tampering
   • CData volume and network bandwidth
   • DDifficulty in analysis and lack of correlation
   Reveal Solution Discussion Select an answer first