Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is preparing for an external audit. They need to demonstrate that their log management system prevents unauthorized modification and deletion of logs. They also need to show that logs are retained for the required period. Which combination of controls should they implement?

   • AA backup of logs stored on a separate server with no access controls.
   • BEncryption of logs in transit and at rest.
   • CManual deletion of logs after the retention period to save storage.
   • DImmutable storage for logs, strict access controls, and automated retention policies that enforce the required retention period.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team receives hundreds of low-severity alerts daily. Analysts are overwhelmed and missing critical incidents. They want to reduce manual effort and improve response efficiency. What should they implement?

   • ACreate a dashboard that lists all alerts for analysts to review.
   • BDisable all low-severity alerts to reduce noise.
   • CIncrease the number of analysts to review all alerts manually.
   • DAutomated playbooks that triage alerts, enrich them with context, and escalate only high-confidence incidents to analysts.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services company must retain audit logs for seven years to meet regulatory requirements, but the SIEM's hot storage is expensive. The logs are rarely accessed after the first 90 days. What is the most cost-effective approach that still meets compliance?

   • AMove logs older than 90 days to a lower-cost archival tier while keeping them searchable and tamper-evident, and retain them for seven years.
   • BStore all logs in the SIEM's hot storage for seven years to ensure immediate query performance.
   • CDelete logs older than 90 days to save storage costs, since the regulatory requirement is only for the current year.
   • DCompress logs and store them on the same hot tier, but disable indexing to reduce costs.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary security objective for protecting log data in transit?

   • AEnsuring logs are not modified during transmission
   • BEnsuring logs are compressed to reduce bandwidth
   • CEnsuring logs are encrypted to prevent unauthorized access
   • DEnsuring logs are normalized for analysis
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team wants to automate the response to a known malware signature detected in endpoint logs. They have a SOAR platform integrated with their SIEM. They need to ensure that the response is consistent and does not require manual intervention. What is the best approach?

   • ACreate a SOAR playbook that triggers on the SIEM alert, automatically isolates the affected endpoint, and notifies the incident response team.
   • BSend an email to the security team and wait for them to manually isolate the endpoint.
   • CDisable the endpoint's network access at the firewall manually when an alert is seen.
   • DCreate a dashboard that shows all malware alerts and let analysts decide.
   Reveal Solution Discussion Select an answer first