Comprehensive Logging and Aggregation GCAD Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A financial services company must retain audit logs for seven years per regulatory requirements. They are designing a log aggregation pipeline that sends logs to a SIEM for active monitoring. The compliance team requires that logs remain tamper-evident and available for forensic investigation throughout the retention period. Which combination of actions should the company take?

   • AStore logs only in the SIEM's hot storage for seven years, relying on the SIEM's access controls to prevent tampering.
   • BUse a log forwarding agent that hashes each log entry and stores the hash chain in a separate database, but only keep logs for one year.
   • CWrite logs to a standard object storage bucket and set a lifecycle policy to delete them after seven years.
   • DForward logs to the SIEM for monitoring, and simultaneously write the raw logs to an immutable object storage bucket with versioning enabled and a retention lock.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A multinational company must comply with data residency laws that require logs containing personal data to remain within the country of origin. They currently aggregate all logs to a SIEM in a central region. The compliance team has mandated that logs containing personal data must be stored in the region where the data was collected. The security team still needs global visibility for threat detection. Which architecture best satisfies both requirements?

   • ADeploy regional log aggregation points that filter and store personal data locally, and forward only non-personal metadata to the central SIEM for global correlation.
   • BStore all logs in the central SIEM and rely on the SIEM's access controls to restrict access to personal data.
   • CEncrypt all logs and store them in the central SIEM, arguing that encryption satisfies data residency.
   • DUse a single global SIEM but configure it to store logs in the region where they were generated.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security architect is designing a logging strategy for a new cloud application. The application runs on virtual machines behind a load balancer, uses a managed database, and authenticates users via an identity provider. Which set of log sources should be included to ensure comprehensive security monitoring?

   • AOnly the VM guest OS logs and identity provider logs.
   • BLoad balancer access logs, VM guest OS logs, database audit logs, and identity provider authentication logs.
   • COnly the cloud provider's infrastructure logs, such as virtual network and storage logs.
   • DOnly the load balancer access logs and database audit logs.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company operates in a region with strict data residency requirements, mandating that all logs must remain within the country's borders. They are considering a cloud-based SIEM that offers multiple regional deployments. Which factor is most critical in their decision?

   • ASelecting a SIEM deployment region that is physically located within the required country.
   • BSelecting a SIEM with the lowest cost per GB of ingested logs.
   • CSelecting a SIEM that supports the most log source integrations.
   • DSelecting a SIEM that offers the most advanced machine learning features.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is a key consideration when designing a logging architecture for a cloud environment?

   • AUsing a single log format for all sources to simplify parsing
   • BDisabling verbose logging to reduce storage costs
   • CEnsuring logs are collected from all relevant sources and aggregated in a centralized location
   • DStoring logs only in the region where they are generated to reduce latency
   Reveal Solution Discussion Select an answer first