Local vs. Centralized Log Management SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key benefit of centralized log management?

   • AIt requires no additional storage
   • BIt allows correlation of events across multiple systems
   • CIt reduces the need for network bandwidth
   • DIt eliminates the risk of log tampering
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company uses local log management on all servers. During a forensic investigation, the analyst discovers that logs on several servers have been modified, but the company has no way to prove when the modification occurred. What is the most significant challenge of local log management illustrated by this?

   • ADifficulty in storing large volumes of logs
   • BInability to generate any logs
   • CLack of tamper-evidence and chain of custody
   • DHigh network bandwidth consumption
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which statement best describes how logs are managed in a local log management setup?

   • ALogs are forwarded to a central collector for analysis
   • BLogs are retained and reviewed on the same machine that produced them
   • CLogs are encrypted and stored in a central database
   • DLogs are automatically deleted after a short retention period
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A regional bank with branches in three cities must detect a multi-stage attack that spans a phishing email, a workstation compromise, and lateral movement to a database server. Each system currently stores logs locally. Which capability of centralized log management is most directly needed to detect this attack?

   • ACorrelating events across multiple systems to see the full attack chain.
   • BEliminating the need for endpoint detection tools on workstations.
   • CReducing the total volume of logs generated by each system.
   • DStoring logs in a tamper-proof format to prevent any modification.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A freelance IT consultant manages a single web server for a client. The client only needs to troubleshoot occasional errors and does not want to pay for extra infrastructure. Which log management approach is most appropriate?

   • AKeep logs locally on the web server and review them directly when issues arise.
   • BDisable logging to save disk space.
   • CSet up a centralized log server on a separate virtual machine.
   • DUse a cloud-based log management service with real-time alerts.
   Reveal Solution Discussion Select an answer first