Comprehensive Logging and Aggregation GCAD Practice Questions (Page 11)

Questions 51–53

1. 51expert · hard

   A security analyst is investigating a potential insider threat. The analyst has access to aggregated logs from the cloud provider, the identity provider, the VPN gateway, and the file storage service. The analyst needs to determine whether an employee accessed sensitive files outside of business hours and whether that access was anomalous. Which correlation approach is most effective?

   • AReview only the VPN logs to see when the employee logged in.
   • BReview the identity provider logs to see if the employee's account was used from multiple locations.
   • CReview only the file access logs to see which files were accessed.
   • DCorrelate VPN login times with file access logs and compare against the employee's baseline behavior.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A security team is investigating a potential insider threat. An employee with access to a cloud storage service is suspected of downloading a large volume of sensitive data. Which log source would provide the most direct evidence of the employee's actions, including the specific files accessed?

   • AIdentity provider logs that show the employee's authentication events.
   • BCloud provider audit logs that show only the API calls made by the employee.
   • CNetwork flow logs that show the volume of data transferred to the employee's workstation.
   • DCloud storage access logs (e.g., S3 server access logs) that record each request with the user identity and object key.
   Reveal Solution Discussion Select an answer first
3. 53application · medium

   A company operates in a highly regulated industry and must retain logs for five years. They are designing a log aggregation pipeline and want to minimize storage costs while still meeting compliance. Which approach is most cost-effective?

   • AStore logs only in the SIEM's internal database for five years.
   • BUse a tiered storage strategy: keep logs in hot storage for 30 days for active analysis, then move them to cold/archive storage for the remaining retention period.
   • CStore all logs in hot storage for the full five years to ensure fast access at all times.
   • DDelete logs older than one year to reduce storage costs.
   Reveal Solution Discussion Select an answer first