Comprehensive Logging and Aggregation GCAD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a log retention policy?

   • ATo ensure logs are kept for the required period to meet compliance and operational needs
   • BTo format logs in a consistent structure
   • CTo delete all logs as soon as possible to reduce storage costs
   • DTo encrypt logs at rest
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing a suspected data exfiltration incident. The attacker is believed to have used a compromised application service account to access sensitive data via the cloud provider's API. Which combination of log sources would provide the most direct evidence of the API calls and the data access?

   • ALoad balancer access logs and CDN logs.
   • BOperating system authentication logs from the application server.
   • CCloud provider API audit logs and application-level database access logs.
   • DNetwork flow logs and DNS logs only.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During an incident response, an analyst needs to determine whether an attacker accessed a specific database table. The database is hosted on an EC2 instance, and the attacker is believed to have used SQL injection through a web application. Which combination of logs would provide the most complete evidence of the attack path?

   • ADatabase query logs alone.
   • BWeb application firewall logs, application logs, and database query logs.
   • CVPC Flow Logs and CloudTrail logs.
   • DEC2 instance system logs and application logs.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a key feature to look for when selecting a centralized log management tool?

   • AAbility to run on a single server without scaling
   • BBuilt-in antivirus capabilities
   • CIntegration with physical access control systems
   • DSupport for multiple log formats and sources
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   During a security incident, an analyst needs to reconstruct the attacker's actions across multiple cloud services. The analyst has access to aggregated logs, but the logs are incomplete because some sources were not enabled. Which action would most improve the completeness of the investigation?

   • AInterview the system administrators to ask what they observed during the incident.
   • BRely on memory forensics of the compromised systems to reconstruct the attacker's actions.
   • CEnable all relevant logging sources now and use the newly collected logs to fill gaps in the investigation.
   • DUse the available logs to identify the attack path and then correlate with any other available data sources, such as network flow logs or backups.
   Reveal Solution Discussion Select an answer first