Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is migrating to a new cloud provider and needs to ensure that all security-relevant logs are collected. The security team has identified the cloud provider's native logging services, but they are unsure if they are capturing everything. What is the best way to verify complete log coverage?

   • AAsk the cloud provider to send all logs to the SIEM automatically.
   • BCompare the list of enabled log sources against a checklist of all security-relevant services and assets.
   • CEnable all possible logging options in the cloud provider and assume coverage is complete.
   • DRely on the cloud provider's default logging settings.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company operates a hybrid environment with workloads in AWS, Azure, and on-premises VMware. The security team needs a single platform to analyze logs from all sources. They want to avoid building custom parsers for each source and prefer a solution that provides built-in normalization. Which approach best meets these requirements?

   • AWrite custom scripts to convert every log format into JSON and store them in a cloud object store.
   • BDeploy a SIEM platform with pre-built connectors and a common data model, and route all logs to it via agents or API integrations.
   • CUse a simple syslog server to collect all logs and store them in raw format for manual review.
   • DConfigure each cloud provider's native monitoring service to send logs to its own dashboard and access them separately.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large enterprise ingests logs from multiple business units that use different log formats for the same type of event (e.g., authentication). The SIEM team wants to enable cross-unit correlation, but the business units are resistant to changing their source applications. What is the most effective approach?

   • ARequire each business unit to modify their applications to output a standardized format.
   • BImplement a normalization layer in the SIEM that maps each source's format to a common schema, and use that schema for correlation.
   • CStore logs in their native format and use a search tool that can query all formats simultaneously.
   • DCreate separate correlation rules for each business unit and manually combine results.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of correlating logs to detect an operational anomaly?

   • ADeleting logs older than 90 days
   • BEncrypting logs before transmission
   • CStoring logs in separate buckets by source
   • DComparing CPU usage logs with application response times
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company must retain logs for 5 years for compliance, but the SIEM vendor charges high fees for long-term storage. The logs are needed for incident investigations that may occur anytime. The team is considering moving older logs to a separate archival store. What is the primary trade-off they must address?

   • AThe archival store will not be able to meet compliance requirements.
   • BThe archival store will not support the same log formats.
   • CThe archival store may have higher latency for querying, which could delay investigations.
   • DThe archival store will require more storage space than the SIEM.
   Reveal Solution Discussion Select an answer first