What is the purpose of using immutable storage for logs?

To prevent logs from being modified or deleted after they are written

To reduce the storage cost of logs

Which of the following is a typical compliance requirement that influences log retention policies?

PCI DSS requires retaining audit logs for at least one year

SOC 2 requires retaining logs for at least 5 years

ISO 27001 requires retaining logs for exactly 10 years

GDPR requires retaining all logs indefinitely

A financial services company must retain audit logs for seven years to meet regulatory requirements. They also need to ensure that logs cannot be altered or deleted by attackers who might compromise administrative accounts. Which storage strategy best satisfies both requirements?

Store logs in a standard S3 bucket with versioning enabled and rely on IAM policies to restrict deletion.

Write logs to an S3 bucket with Object Lock enabled in compliance mode for seven years.

Use a log management tool that allows log rotation after 90 days and stores summaries for seven years.

Keep logs on an on-premises NAS with weekly backups to tape.

What is the primary function of a SIEM tool?

To replace the need for firewalls and intrusion prevention systems

To manage user identities and access permissions

To aggregate, correlate, and analyze security logs from multiple sources in real time

To store backups of all application data

A company has a multi-cloud environment with workloads in AWS and Azure, plus Kubernetes clusters running in both clouds. The security operations team wants to centralize logs for real-time alerting and historical search. They need to minimize the number of agents and avoid vendor lock-in. Which approach best meets these requirements?

Use a cloud-native SIEM from one cloud provider and forward all logs to it using that provider's agent.

Use AWS CloudWatch Logs for AWS resources and Azure Monitor for Azure resources, and query each separately.

Use a self-hosted SIEM with a universal log forwarder that supports AWS, Azure, and Kubernetes.

Store logs in each cloud's object storage and use a separate analytics tool for each.

GIAC Cloud Security Architecture and Design

Domain 4Objective 1

Comprehensive Logging and Aggregation GCAD Practice Questions (Page 2)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 6–10

6foundation · easy
What is the purpose of using immutable storage for logs?
Select an answer first
7foundation · easy
Which of the following is a typical compliance requirement that influences log retention policies?
Select an answer first
8application · medium
A financial services company must retain audit logs for seven years to meet regulatory requirements. They also need to ensure that logs cannot be altered or deleted by attackers who might compromise administrative accounts. Which storage strategy best satisfies both requirements?
Select an answer first
9foundation · easy
What is the primary function of a SIEM tool?
Select an answer first
10application · medium
A company has a multi-cloud environment with workloads in AWS and Azure, plus Kubernetes clusters running in both clouds. The security operations team wants to centralize logs for real-time alerting and historical search. They need to minimize the number of agents and avoid vendor lock-in. Which approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.