Comprehensive Logging and Aggregation GCAD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is evaluating centralized log management tools. They need to aggregate logs from cloud infrastructure, applications, and network devices, and they want to build custom correlation rules to detect threats. They also want to minimize the operational overhead of maintaining the platform. Which tool characteristic is most important to consider?

   • AA built-in dashboard that displays all logs in a single view.
   • BSupport for a wide range of log input formats and APIs for custom integrations.
   • CA large partner ecosystem for add-on applications.
   • DA low initial purchase price.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common method for aggregating logs from distributed sources?

   • ASending logs via email to the security team
   • BDisabling logging on non-critical systems
   • CUsing a message queue to transport logs to a central collector
   • DStoring logs locally on each server and manually reviewing them
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is designing a logging architecture for a multi-tenant SaaS platform. They must ensure that logs from different customers are isolated to prevent cross-tenant data leakage, while also meeting a regulatory requirement to retain logs for five years. Which design best satisfies both requirements?

   • AUse a single log stream but encrypt it with a customer-managed key for each tenant.
   • BAggregate all tenant logs into a single stream and rely on the SIEM to filter by tenant during queries.
   • CStore each tenant's logs in separate storage accounts but only retain them for one year to reduce costs.
   • DUse a separate log stream or partition for each tenant, with access controls that restrict each tenant's logs to authorized personnel, and store all streams in a central immutable store for five years.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which log source is most important for detecting unauthorized access attempts to a web application?

   • AApplication logs
   • BOperating system logs
   • CCloud provider audit logs
   • DNetwork flow logs
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst notices a spike in failed login attempts against a web application, followed by a successful login from an unusual IP address. Shortly after, the same IP address is seen making API calls to create a new administrative user. Which correlation of log sources would most effectively confirm this as a security incident?

   • ACorrelate network flow logs with DNS logs.
   • BCorrelate database query logs with application performance logs.
   • CCorrelate web application authentication logs with cloud provider API audit logs.
   • DCorrelate firewall logs with load balancer logs.
   Reveal Solution Discussion Select an answer first