Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security architect is designing a log integration architecture for a multi-cloud environment. The goal is to aggregate logs from various cloud services, on-premises systems, and SaaS applications into a single platform for operational visibility. Which approach best describes the core purpose of this architecture?

   • ATo replace all existing logging mechanisms with a single vendor's proprietary format
   • BTo store logs locally on each source system to avoid network bandwidth consumption
   • CTo encrypt all logs at the source and prevent any third-party access
   • DTo collect logs from diverse sources and forward them to a central platform for storage, analysis, and alerting
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is integrating logs from a legacy mainframe, cloud workloads, and IoT devices. The mainframe logs use a fixed-width format, cloud logs are JSON, and IoT devices send key-value pairs. They want to detect a specific security pattern that spans all three sources. What is the most effective way to enable this detection?

   • AStore logs in their native formats and use a search engine that supports full-text search across all data.
   • BConvert all logs to CSV and load them into a relational database.
   • CUse separate detection rules for each source and manually combine results.
   • DBuild a normalization layer that converts all formats into a common schema with standard field names, then write correlation rules on that schema.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) receives raw VPN authentication logs that contain only source IP, username, and timestamp. Analysts need to quickly identify logins from known malicious IP addresses and understand the geographic origin of each login. What should the team do to meet this requirement?

   • AFilter out all VPN logs from non-business hours to reduce volume, then analyze the remaining logs.
   • BEnrich the VPN logs with IP geolocation and threat intelligence feeds during ingestion, then create a dashboard that highlights matches.
   • CStore the VPN logs as-is and have analysts manually look up each IP in an external threat intelligence portal.
   • DCreate a dashboard that shows only the raw source IP and username, leaving interpretation to the analysts.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of implementing log retention policies?

   • ATo ensure logs are available for compliance and investigation purposes
   • BTo normalize logs into a common format
   • CTo correlate logs across sources
   • DTo encrypt logs at rest
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An operations team wants to create a dashboard that shows real-time status of a cloud application. They have logs from multiple sources, but the dashboard is slow because it queries raw logs directly. They also need to alert on specific error patterns. What should they do to improve dashboard performance and enable alerting?

   • AQuery raw logs directly for the dashboard and set up alerts on the same raw queries.
   • BPre-aggregate logs into metrics or summary tables that the dashboard queries, and set up alerts on the underlying log queries.
   • CUse a static dashboard that is updated manually each day.
   • DStore logs in a cold storage tier and query them for the dashboard.
   Reveal Solution Discussion Select an answer first