Local vs. Centralized Log Management SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small retail company with five point-of-sale (POS) terminals and no dedicated IT staff wants to keep logs for basic troubleshooting. The POS vendor recommends keeping logs on each terminal for 90 days. The company has no central server and a limited budget. Which approach best fits the stated constraint?

   • AUse a cloud-based log management service to aggregate logs from all terminals.
   • BHave each terminal email its logs daily to the store manager's personal email account.
   • CConfigure each POS terminal to store logs locally and access them directly on the device when needed.
   • DSet up a centralized log server on a spare desktop and forward all POS logs to it over the store's Wi-Fi.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does centralized log management improve incident response?

   • ABy providing a single location to search and analyze logs from all systems
   • BBy making logs available only on the originating system
   • CBy automatically patching vulnerabilities
   • DBy reducing the number of logs generated
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is planning to centralize logs from all servers to a single SIEM. The security team is concerned about the SIEM becoming a target. If the SIEM is compromised, all logs could be lost or altered. Which challenge of centralized log management does this concern illustrate?

   • ADifficulty in analysis
   • BData volume management
   • CSingle point of failure
   • DNetwork bandwidth consumption
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A remote oil rig has a control system that is intentionally isolated from the internet. The system generates logs that are critical for safety audits. The rig has intermittent satellite connectivity. What is the most appropriate log management strategy?

   • ADo not store logs because the system is isolated.
   • BStream logs in real-time to a central server via satellite.
   • CUse a cloud-based SIEM with real-time ingestion.
   • DStore logs locally on the control system and periodically transfer them to a central location when connectivity is available.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small manufacturing plant has a single programmable logic controller (PLC) that controls a critical machine. The PLC is not connected to the corporate network and has limited storage. The plant engineer needs to review logs only when a fault occurs. What is the most appropriate log management approach?

   • ACentralized log management using a cloud SIEM
   • BNo log management at all
   • CCentralized log management to a remote server
   • DLocal log management on the PLC
   Reveal Solution Discussion Select an answer first