Logging and Log Management Tools SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small company uses a SIEM to collect logs from its firewall, antivirus, and Windows servers. The SIEM is generating too many alerts, most of which are false positives. The team wants to reduce noise without missing real threats. Which action is most effective?

   • AAdd more log sources to the SIEM.
   • BDisable all alerts for low-severity events.
   • CTune correlation rules to be more specific and suppress known benign activity.
   • DIncrease the log retention period to store more data.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC team is evaluating two SIEM products. Product A has strong correlation rules but limited support for JSON logs. Product B supports all log formats but has weak correlation capabilities. The team's environment generates a large volume of JSON logs from cloud services, and they need to detect multi-stage attacks. Which product should they choose?

   • AProduct A, because correlation is more important than format support.
   • BProduct B, and rely on manual analysis for correlation.
   • CProduct B, because it can ingest all logs, even if correlation is weak.
   • DProduct A, and use a log shipper to convert JSON to syslog.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has a SIEM with a 30-day hot storage limit. They are required to retain security logs for one year for compliance. They also need to be able to search logs older than 30 days for occasional investigations. Which storage approach is most cost-effective while meeting these needs?

   • AKeep all logs in the SIEM's hot storage for one year.
   • BArchive logs older than 30 days to low-cost object storage and load them into the SIEM when needed for investigation.
   • CDelete logs older than 30 days and rely on the SIEM's reports.
   • DStore logs older than 30 days on tape and do not index them.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC team is configuring a SIEM to receive logs from remote offices over the internet. They need to ensure logs are not tampered with during transmission and that only authorized systems can send logs. Which two controls should they implement?

   • ATLS encryption and mutual authentication with certificates
   • BCompression and rate limiting
   • CSyslog over UDP and a shared secret
   • DIP allowlisting and hashing logs after receipt
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why is logging considered a critical component of a defense-in-depth strategy?

   • AIt eliminates the need for regular security assessments by maintaining a complete record of all vulnerabilities.
   • BIt provides visibility into system activity, which is essential for detecting incidents that bypass other security controls.
   • CIt prevents malware from executing on endpoints by scanning files in real time.
   • DIt encrypts all network traffic to protect data in transit.
   Reveal Solution Discussion Select an answer first