Comprehensive Logging and Aggregation GCAD Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is required by a regulatory body to retain logs for a minimum of three years, but they are also concerned about the cost of long-term storage. They want to ensure that logs are not altered during the retention period. Which storage strategy is most cost-effective while meeting both requirements?

   • AStore logs in a hot tier for one year, then delete them to save costs.
   • BStore logs in a cold storage tier from day one, accepting slower access times.
   • CStore all logs in a hot storage tier for three years to ensure fast access at all times.
   • DUse a tiered storage approach: store recent logs in a hot tier for fast access, then transition them to a low-cost archival tier with object lock for the remainder of the retention period.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center (SOC) is investigating a potential data exfiltration. They have logs from the cloud provider's API activity, the web application firewall, the database audit log, and the endpoint detection and response (EDR) tool. Which approach will most effectively identify the full scope of the incident?

   • ACorrelate the logs by user identity and timestamp to trace the sequence of actions across all systems.
   • BAnalyze each log source independently to identify anomalies in that specific system.
   • CReview the EDR logs first, as they contain the most detailed information about the attacker's actions.
   • DFocus only on the database audit log to identify which records were accessed.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team needs to prove to auditors that their log data has not been tampered with since collection. They currently send logs to a central SIEM. What additional control should they implement to provide cryptographic assurance of log integrity?

   • AEnable TLS encryption for log transmission from sources to the SIEM.
   • BStore logs in a compressed format to save space.
   • CGenerate a hash of each log entry and store the hashes in a separate, write-once store.
   • DUse role-based access control to restrict who can access the SIEM.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A healthcare company is subject to HIPAA, which requires retaining audit logs for six years. They also have an internal policy to retain logs for only one year for privacy reasons. The security team wants to minimize storage costs while ensuring compliance. Which approach best balances these conflicting requirements?

   • ARetain logs for six years but store them in a high-cost, hot storage tier for fast access.
   • BRetain logs for one year and then delete them to comply with the internal privacy policy.
   • CRetain all logs for six years in low-cost, immutable storage, and use access controls to limit who can view logs older than one year.
   • DRetain logs for six years but only keep metadata after one year, deleting the full logs.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary benefit of aggregating logs from multiple sources into a centralized repository?

   • AIt enables correlation and analysis of events across different systems
   • BIt reduces the need for log retention policies
   • CIt automatically encrypts all log data
   • DIt eliminates the need for real-time monitoring
   Reveal Solution Discussion Select an answer first