A security team is designing a log pipeline that spans multiple cloud providers. They need to ensure that logs cannot be altered by an attacker who compromises a single component. They also need to maintain the ability to detect unauthorized access to logs. Which design best meets these requirements?

Store logs in a public cloud bucket with no access controls for simplicity.

Use a write-once-read-many (WORM) storage for logs and separate the log ingestion service from the storage account with distinct credentials.

Encrypt logs with a single key and store the key with the logs.

Use a single service account with full access to all log storage.

A security analyst notices that the SIEM has not generated any alerts for a known brute-force attack pattern that was detected in the past. The logs are normalized, but the correlation rule seems to be missing. What is the most likely cause?

The logs are not being normalized correctly.

The SIEM's storage is full and is dropping new logs.

The correlation rule was not created or was disabled in the SIEM.

The analyst is looking at the wrong dashboard.

Which control is essential for ensuring that only authorized personnel can access log data?

Storing logs in a public cloud bucket

Normalizing logs into a common schema

Implementing role-based access control (RBAC) on the log platform

Compressing logs to reduce storage

A security operations team wants to automate the response to a common incident: a user account being locked out after multiple failed login attempts. The team has a SIEM that can trigger alerts and a ticketing system. What is the most effective automation workflow?

Disable the user account permanently after the first failed login.

Have the SIEM automatically unlock the user account without any human review.

Create a manual process where analysts check the SIEM and manually create tickets.

Create a SIEM alert that automatically creates a ticket and sends an email to the user's manager.

What is the primary purpose of log normalization in a centralized logging platform?

To encrypt logs to protect them from unauthorized access

To reduce the size of log files by compressing them

To convert heterogeneous log formats into a common schema

To delete logs that are not relevant to security

GIAC Cloud Security Architecture and Design

Domain 4Objective 2

Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 10)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 46–50

46expert · hard
A security team is designing a log pipeline that spans multiple cloud providers. They need to ensure that logs cannot be altered by an attacker who compromises a single component. They also need to maintain the ability to detect unauthorized access to logs. Which design best meets these requirements?
Select an answer first
47application · medium
A security analyst notices that the SIEM has not generated any alerts for a known brute-force attack pattern that was detected in the past. The logs are normalized, but the correlation rule seems to be missing. What is the most likely cause?
Select an answer first
48foundation · easy
Which control is essential for ensuring that only authorized personnel can access log data?
Select an answer first
49expert · hard
A security operations team wants to automate the response to a common incident: a user account being locked out after multiple failed login attempts. The team has a SIEM that can trigger alerts and a ticketing system. What is the most effective automation workflow?
Select an answer first
50foundation · easy
What is the primary purpose of log normalization in a centralized logging platform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.