Comprehensive Logging and Aggregation GCAD Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company is designing a comprehensive logging architecture for a serverless application. The application uses a function-as-a-service platform, a managed API gateway, and a managed database. The security team wants to detect and investigate potential attacks. Which combination of log sources is most critical?

   • AOnly function execution logs, as they contain all the application logic.
   • BAPI gateway access logs, function execution logs, and database audit logs.
   • COnly database audit logs, as they show all data access.
   • DOnly API gateway access logs, as they capture all incoming requests.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is an example of a cloud provider log source?

   • ASyslog from a Linux server
   • BWindows Event Logs
   • CApache access logs
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which mechanism is commonly used to ensure log integrity and detect tampering?

   • ABase64 encoding
   • BCompression
   • CLog rotation
   • DCryptographic hashing
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company is designing a log aggregation pipeline for a hybrid cloud environment. They have on-premises servers, AWS, and Azure. The security team wants to centralize logs in a SIEM for real-time alerting, but the network team is concerned about bandwidth usage on the site-to-site VPN. Which approach minimizes bandwidth impact while still providing real-time alerting?

   • AForward all raw logs directly from each source to the SIEM over the VPN.
   • BStore logs on-premises and have the SIEM query them remotely over the VPN.
   • CDeploy a local log collector on-premises that filters and aggregates logs, then forwards only relevant events to the cloud SIEM.
   • DUse a third-party cloud-based log collector that pulls logs from all sources.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a key forensic use of logs during incident response?

   • ADetermining the initial entry point of an attacker
   • BRebuilding affected systems to restore service
   • CDeleting evidence to prevent data leakage
   • DEncrypting all log data to hide it from attackers
   Reveal Solution Discussion Select an answer first