Local vs. Centralized Log Management SCE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A global company with offices in multiple countries must comply with data residency laws that require logs to stay within each country. They also need to correlate security events across all offices. What is the most appropriate architecture?

   • ASend all logs to a single SIEM in the company's headquarters country.
   • BKeep all logs local and do not share any data across countries.
   • CUse a cloud SIEM that stores all logs in a single region.
   • DDeploy regional central log collectors in each country and aggregate summaries to a global SIEM.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A small law firm with 15 workstations and no dedicated IT staff keeps all Windows event logs locally on each machine. The firm has no compliance requirements and rarely investigates incidents. The owner asks if they should move to a centralized log server. Based on the trade-offs, what is the most appropriate recommendation?

   • AKeep logs local but require daily manual review of each workstation's logs by the owner.
   • BKeep logs local because the environment is small and the operational overhead of a central server is not justified.
   • CCentralize logs immediately because local logs are always insecure and cannot be used for any analysis.
   • DCentralize logs only if the firm can afford a commercial SIEM; otherwise local logs are useless.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In local log management, where are logs typically stored and managed?

   • AOn removable media that is physically transported between systems
   • BIn a cloud-based SIEM that ingests logs from various sources
   • COn the individual system that generated them, in local files or a local database
   • DOn a central server that collects logs from multiple systems
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a potential risk of relying on a single central log server?

   • AIt becomes a single point of failure
   • BLogs are stored on each individual system
   • CIt eliminates the need for log retention policies
   • DIt increases the attack surface on each endpoint
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is centralizing logs from 500 network devices. The network team is worried that sending all logs to the central server will saturate the network link. Which approach would best mitigate this risk?

   • AUse a wireless network for log forwarding to reduce cabling costs.
   • BStore logs locally on each device and never forward them.
   • CConfigure devices to send only critical logs and use a dedicated management network for log forwarding.
   • DSend all logs in real time without any filtering to ensure complete data.
   Reveal Solution Discussion Select an answer first