A company's SIEM receives logs from VPN gateways and identity providers. The security team wants to automatically detect when a user authenticates to the VPN from a new geographic location and then accesses a sensitive application within 10 minutes. What is the most effective approach?

Store logs in a data lake and run a monthly batch query for unusual access patterns.

Create a correlation rule that joins VPN authentication logs with application access logs based on user identity and time window.

Enable verbose logging on the VPN gateway and application servers.

Set up a dashboard that displays all VPN and application logs side by side for manual review.

An operations team wants to monitor a cloud application for unusual error rates. They have integrated logs into a monitoring platform. What should they configure to be notified immediately when the error rate exceeds a threshold?

Export logs to a spreadsheet and review them at the end of the day.

Set up an alert rule that queries the log stream for error events and triggers a notification when the count exceeds a threshold.

Create a dashboard that shows error rates and check it every hour.

Store logs in a cold storage tier for later analysis.

Which of the following is a typical step in parsing a raw log entry?

Encrypting the log with a public key

Compressing the log to save storage space

Deleting logs older than a certain age

Extracting key-value pairs or fields from the log message

What is the primary goal of log correlation across multiple sources?

To normalize logs into a common format

To encrypt logs for secure storage

To reduce the number of logs stored

To detect security incidents by identifying relationships between events

An organization is preparing for an external audit that requires proof that logs have not been tampered with and that access to logs is logged. What should the organization implement to satisfy the auditor?

A backup of logs stored in the same location as the primary logs.

A policy that allows administrators to edit logs to correct errors.

A log retention policy that deletes logs after 30 days to reduce exposure.

A cryptographic hash chain of log entries and an audit trail of all access to the log repository.

GIAC Cloud Security Architecture and Design

Domain 4Objective 2

Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 7)

Part of the Logging, Monitoring, and Incident Response domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 31–35

31application · medium
A company's SIEM receives logs from VPN gateways and identity providers. The security team wants to automatically detect when a user authenticates to the VPN from a new geographic location and then accesses a sensitive application within 10 minutes. What is the most effective approach?
Select an answer first
32application · medium
An operations team wants to monitor a cloud application for unusual error rates. They have integrated logs into a monitoring platform. What should they configure to be notified immediately when the error rate exceeds a threshold?
Select an answer first
33foundation · easy
Which of the following is a typical step in parsing a raw log entry?
Select an answer first
34foundation · easy
What is the primary goal of log correlation across multiple sources?
Select an answer first
35application · medium
An organization is preparing for an external audit that requires proof that logs have not been tampered with and that access to logs is logged. What should the organization implement to satisfy the auditor?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.