An organization is onboarding logs to a central SIEM. They have enabled logging for their cloud VMs, container platform, and SaaS applications. During a compliance review, they discover that audit requirements mandate logging of all administrative actions on the cloud control plane. Which additional log source must be onboarded?

Network flow logs from virtual networks

Cloud provider audit logs (e.g., AWS CloudTrail, Azure Activity Log)

Application-level access logs from web servers

DNS query logs from internal resolvers

What is the purpose of enriching a log entry with geolocation data?

To provide additional context about the source of an IP address

To encrypt the log for secure transmission

To reduce the log's storage size

A security operations center is overwhelmed by false positives from alerts that only use raw IP addresses. They want to reduce false positives by adding context to logs. They have a threat intelligence feed and an identity management system. Which enrichment strategy is most effective?

Enrich logs only with geolocation data to identify the country of origin.

Enrich logs with the user's department and manager name.

Enrich logs only with threat intelligence reputation scores.

Enrich logs with both threat intelligence reputation scores and user identity information, then create alerts that require both high-risk IP and privileged user context.

A security analyst is investigating a series of failed login attempts from various IP addresses. The raw logs only contain IP addresses and timestamps. To quickly identify whether these attempts originate from known malicious infrastructure, what should be added to the logs?

Threat intelligence enrichment that tags IP addresses with reputation scores and known indicators.

Geolocation data only, showing the country of each IP address.

The internal hostname of the authentication server.

User agent strings from the login requests.

A security team is designing a log pipeline that sends logs from multiple sources to a central SIEM. They are concerned about an attacker modifying logs to cover their tracks. Which control should be implemented to detect tampering?

Generate cryptographic hashes of log entries and store them in a separate immutable store.

Use a log shipper that compresses logs before sending.

Encrypt logs in transit using TLS.

Restrict access to the SIEM to a small group of administrators.

GIAC Cloud Security Architecture and Design

Domain 4Objective 2

Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 4)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 16–20

16application · medium
An organization is onboarding logs to a central SIEM. They have enabled logging for their cloud VMs, container platform, and SaaS applications. During a compliance review, they discover that audit requirements mandate logging of all administrative actions on the cloud control plane. Which additional log source must be onboarded?
Select an answer first
17foundation · easy
What is the purpose of enriching a log entry with geolocation data?
Select an answer first
18expert · hard
A security operations center is overwhelmed by false positives from alerts that only use raw IP addresses. They want to reduce false positives by adding context to logs. They have a threat intelligence feed and an identity management system. Which enrichment strategy is most effective?
Select an answer first
19application · medium
A security analyst is investigating a series of failed login attempts from various IP addresses. The raw logs only contain IP addresses and timestamps. To quickly identify whether these attempts originate from known malicious infrastructure, what should be added to the logs?
Select an answer first
20application · medium
A security team is designing a log pipeline that sends logs from multiple sources to a central SIEM. They are concerned about an attacker modifying logs to cover their tracks. Which control should be implemented to detect tampering?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.