Comprehensive Logging and Aggregation GCAD Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company runs a hybrid infrastructure with workloads in AWS and on-premises. The security team needs to detect cross-environment attacks, such as an on-premises compromise leading to AWS API abuse. They want a single pane of glass for searching and correlating logs. What should they implement?

   • AEnable AWS CloudTrail and use Athena to query only the cloud logs, ignoring on-premises logs.
   • BConfigure AWS CloudTrail to send logs to an on-premises SIEM, and also forward on-premises firewall logs to the same SIEM.
   • CStore AWS CloudTrail logs in S3 and on-premises logs in a local syslog server, then manually compare them during investigations.
   • DUse a separate SIEM for each environment and share reports via email weekly.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is evaluating SIEM solutions. They have a small security team with limited SIEM administration experience, and they want to reduce the operational overhead of maintaining the SIEM infrastructure. They also need to ingest logs from Office 365, AWS, and on-premises firewalls. Which type of SIEM deployment is most appropriate?

   • AA self-hosted open-source SIEM deployed on their own virtual machines.
   • BA SIEM appliance installed in their on-premises data center.
   • CA cloud-based SIEM service offered by a vendor that provides built-in connectors for the required sources.
   • DA custom-built log aggregation system using a database and custom scripts.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of log correlation?

   • ATo reduce the volume of logs by removing duplicates
   • BTo format logs into a common schema
   • CTo identify relationships between events from different sources to detect security incidents
   • DTo archive logs for long-term storage
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is investigating a suspected breach. The organization uses a centralized log management platform that receives logs from multiple sources. The analyst needs to prove to a court that the logs have not been altered since collection. Which mechanism provides the strongest evidence of log integrity?

   • AAccess control lists that restrict who can read the log files.
   • BA backup of the logs stored on a different server.
   • CA cryptographic hash of each log file stored in a separate, write-once system.
   • DA timestamp added by the log source when the event occurred.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During an incident response, an analyst needs to determine the exact time an attacker first accessed a compromised virtual machine and what commands were executed. Which log sources, when aggregated, would provide the most complete evidence?

   • ACloud provider's API logs (e.g., VM creation, login events) and the guest OS's authentication and command history logs.
   • BLoad balancer access logs and CDN logs.
   • CNetwork flow logs and DNS query logs.
   • DApplication logs from the web server and database audit logs.
   Reveal Solution Discussion Select an answer first