Comprehensive Logging and Aggregation GCAD Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company has a distributed microservices architecture running on Kubernetes. They want to aggregate logs from all pods into a central system for searching and alerting. Which approach is most efficient and scalable for collecting logs from Kubernetes?

   • AStore logs only in the container's stdout and rely on the container runtime's local storage.
   • BDeploy a DaemonSet that runs a log collector on each node to forward container logs to a central log management system.
   • CUse kubectl logs to manually collect logs from each pod when needed.
   • DConfigure each pod to include a sidecar container that sends logs directly to the central system.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security operations center is investigating a series of suspicious activities. They notice that a user's account was used to log in from two different geographic locations within a short time period, and then the same account was used to modify firewall rules. Which correlation of logs would most effectively identify this as a potential account compromise?

   • ACorrelate application logs with database logs.
   • BCorrelate network flow logs with DNS logs.
   • CCorrelate identity provider authentication logs with cloud provider audit logs.
   • DCorrelate firewall logs with load balancer logs.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is required by regulation to retain logs for at least three years and must be able to prove that logs have not been modified. They are using a SIEM for real-time monitoring and a separate storage system for long-term retention. Which configuration provides the strongest tamper-evidence for the retained logs?

   • ACompress logs and store them on a network-attached storage (NAS) device with a backup schedule.
   • BStore logs in a relational database with strict access controls and audit logging.
   • CExport logs to a SIEM and rely on the SIEM's built-in data retention features.
   • DWrite logs to an object storage bucket with object lock enabled and a retention period of three years.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is migrating a legacy application to the cloud. The application runs on virtual machines and uses a managed database. The security team wants to ensure that all security-relevant events are captured. Which logging architecture should they implement?

   • AEnable only the cloud provider's audit logs and database audit logs.
   • BEnable only VM guest OS logs and application logs.
   • CEnable cloud provider audit logs, VM guest OS logs, database audit logs, and application logs, and forward all to a centralized SIEM.
   • DEnable only the cloud provider's network logs and VM guest OS logs.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team is evaluating SIEM solutions. They have a high volume of logs (several terabytes per day) and need to support complex correlation queries. They also have a limited budget and want to avoid over-provisioning infrastructure. Which deployment model is most suitable?

   • AA cloud SIEM with a fixed number of nodes that you manage yourself.
   • BAn on-premises SIEM with a fixed-capacity cluster sized for peak log volume.
   • CA cloud-native SIEM that scales automatically and charges based on ingestion volume.
   • DA self-managed open-source SIEM deployed on a single large server.
   Reveal Solution Discussion Select an answer first