Comprehensive Logging and Aggregation GCAD Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A healthcare organization must retain logs for six years per HIPAA, but they also need to support ongoing security investigations that may require logs older than six months. They are designing a log retention policy. Which approach best balances compliance, investigation needs, and storage cost?

   • AKeep all logs in hot storage for six years to ensure fast access for any investigation.
   • BStore logs only in the SIEM's hot storage for six years, relying on the SIEM's search capabilities.
   • CKeep logs in hot storage for six months for active investigations, then move them to immutable archive storage for the remaining five and a half years.
   • DDelete logs after six months to reduce storage costs.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company runs a multi-cloud environment with workloads in AWS and Azure. The security team wants to centralize logs from both clouds plus on-premises network devices into a single SIEM. They need to preserve the original log content for compliance and also enable near-real-time correlation. Which approach best meets these requirements?

   • AStore all logs in the SIEM's native storage and rely on the SIEM's retention policies to meet compliance requirements.
   • BUse a single cloud provider's log aggregation service to pull logs from all sources and then forward them to the SIEM.
   • CConfigure native cloud logging agents to forward logs directly to the SIEM, and retain a copy of raw logs in each cloud's native storage.
   • DHave each cloud provider send logs to its own native monitoring service, and have the SIEM query those services periodically for analysis.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security architect is designing a tamper-proof logging solution for a high-security environment. The requirement is to detect any modification of logs, even by a compromised SIEM administrator. The logs are currently stored in a SIEM that the administrator has full access to. Which additional control would provide the strongest assurance of log integrity?

   • AUse a SIEM feature that allows log deletion only after a two-person approval.
   • BContinuously forward a hash of each log batch to a separate, write-once external service that the SIEM administrator cannot access.
   • CEnable multi-factor authentication on the SIEM administrator account.
   • DStore logs in a separate network segment with strict firewall rules.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A security architect is designing a logging architecture for a multi-cloud environment. Which of the following is the primary purpose of a comprehensive logging architecture?

   • ATo replace the need for network security monitoring tools
   • BTo store all log data indefinitely in a single repository for future analysis
   • CTo capture security-relevant events from all layers of the cloud stack to enable detection, investigation, and compliance
   • DTo provide real-time alerts for every security event without human analysis
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During incident response, what is the primary value of aggregated logs?

   • AThey replace the need for forensic tools
   • BThey automatically remediate security incidents
   • CThey guarantee the identity of the attacker
   • DThey provide a comprehensive timeline of events for investigation and forensic analysis
   Reveal Solution Discussion Select an answer first