Logging and Log Management Tools SCE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SIEM administrator needs to ingest logs from a network device that outputs key-value pairs with variable field names. The SIEM's parser expects a fixed schema. What is the most efficient way to normalize these logs?

   • AAsk the device vendor to change the log format.
   • BStore the logs as raw text and search with regex.
   • CUse a log parser or shipper to convert the key-value pairs into a structured format like JSON or CEF.
   • DManually edit each log entry to match the SIEM schema.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a best practice for ensuring the integrity of log data?

   • AAllow all administrators to edit log files to correct errors.
   • BUse write-once, read-many (WORM) storage or cryptographic hashing to detect unauthorized modifications.
   • CStore logs in plain text on the same server that generates them.
   • DDelete logs older than 30 days to reduce the attack surface.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has a SIEM but is missing logs from several network switches. The switches support syslog but not the SIEM's native agent. What is the most effective way to collect these logs?

   • AInstall a SIEM agent on each switch.
   • BUse SNMP traps to send logs to the SIEM.
   • CManually copy logs from each switch to the SIEM.
   • DConfigure the switches to send syslog to a central syslog server that forwards to the SIEM.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global company needs to collect logs from offices in different countries. Some offices have low-bandwidth connections. The logs must be transmitted securely and arrive at the central SIEM without loss. Which collection architecture is most appropriate?

   • AHave each device send syslog over UDP directly to the central SIEM.
   • BUse local collectors that buffer logs, compress them, and forward over TLS to the central SIEM.
   • CHave devices send logs via email to the SIEM.
   • DUse a VPN tunnel from each office to the central site and send plain syslog over it.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a common strategy for managing log storage costs while maintaining availability for recent logs?

   • ACompress logs and keep them on the same device that generated them.
   • BUse tiered storage: keep recent logs on fast, expensive storage and archive older logs to cheaper, slower storage.
   • CDelete logs older than 24 hours to save space.
   • DStore all logs in memory for instant access.
   Reveal Solution Discussion Select an answer first