Local vs. Centralized Log Management SCE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   In centralized log management, how are logs from different sources handled?

   • AThey are printed and archived in a physical location
   • BThey are discarded after a brief review
   • CThey are stored separately on each source system
   • DThey are transmitted to a central server and stored in a common format
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is planning to centralize logs from 2,000 servers to a single SIEM. The security team is concerned about the SIEM becoming a bottleneck and about the cost of storage. Which measure would best address these concerns while still gaining the benefits of centralization?

   • AStore logs only on each server and access them remotely when needed.
   • BFilter and prioritize logs at the source so only high-value events are forwarded.
   • CForward all logs without any filtering to ensure no data is missed.
   • DUse a separate SIEM for each department to distribute the load.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In which scenario is local log management most appropriate?

   • AA small business with a few standalone servers that are not networked
   • BA regulated industry that must provide audit logs to regulators
   • CA security operations center that monitors network-wide threats
   • DA large enterprise with thousands of servers across multiple data centers
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is investigating a potential data exfiltration. The analyst needs to see if a user logged into a server, accessed a file share, and then transferred data to an external IP. The logs are currently stored locally on each system. What is the most efficient way to perform this investigation?

   • AOnly review the firewall logs because they show all external traffic.
   • BAsk each system administrator to provide their logs via email.
   • CUse a centralized log management platform to search all relevant logs in one place.
   • DManually log into each system and review the local logs sequentially.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A startup with 10 employees and a single office is considering moving from local to centralized log management. They have no compliance requirements and their main concern is keeping costs low. What should they consider?

   • ACentralized log management is always cheaper than local log management.
   • BCentralized log management is required for any company with more than five employees.
   • CCentralized log management eliminates the need for any local storage.
   • DCentralized log management adds infrastructure and operational overhead that may not be justified at this scale.
   Reveal Solution Discussion Select an answer first