Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An organization is migrating from on-premises to a multi-cloud environment. They have a SIEM that currently ingests on-premises logs. They need to ensure complete coverage of cloud services, including serverless functions, container orchestration, and SaaS applications. They also need to meet audit requirements for user activity. What is the most comprehensive approach?

   • AUse a single cloud provider's monitoring tool to collect all logs and export them to the SIEM.
   • BEnable native logging for each cloud service and use API integrations to stream those logs to the SIEM, including audit logs for user activity.
   • CInstall agents on all cloud VMs and forward only VM logs to the SIEM.
   • DManually export logs from each service on a weekly basis and upload them to the SIEM.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A healthcare organization must maintain audit logs for six years under data protection regulations. They are designing a log integration and need to ensure logs are admissible in legal proceedings. Which combination of controls is most important?

   • AStoring logs in a proprietary format for the retention period.
   • BCompression and encryption of logs at rest.
   • CReal-time alerting on all log events.
   • DTamper-evident logging with cryptographic hashes and strict access controls.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security operations team receives logs from firewalls, endpoints, and cloud services in different formats. They want to create a unified dashboard that shows failed login attempts across all sources. What is the most efficient way to enable this?

   • AStore logs in their original format and use text search for 'failed login' across all data.
   • BCreate separate dashboards for each source and manually compare them.
   • CImplement a parsing and normalization layer that maps each source's fields to a common schema, then build the dashboard on that schema.
   • DConvert all logs to PDF reports and email them to analysts.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is onboarding a new cloud service that generates logs in a custom JSON format. The security team wants to automate the ingestion and parsing so that new log sources can be added without manual configuration each time. What should the team implement?

   • AA manual process where analysts copy and paste logs into the SIEM.
   • BA log ingestion pipeline that uses a schema registry and automated parsing rules to handle new formats dynamically.
   • CA one-time migration of the new service's logs into the SIEM using a custom parser.
   • DA script that manually converts each new log format and uploads it to the SIEM.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC team wants to create a dashboard that shows failed login attempts across all cloud and on-premises systems. The logs are already normalized into a common schema with a field named 'event_type' that has values like 'login_failure'. What is the most effective way to build this dashboard?

   • ACreate an alert that triggers on any login failure and send it to the dashboard.
   • BCreate a visualization that counts events where event_type equals 'login_failure', grouped by source system and time.
   • CUse a raw log search for 'failed' and display the results in a table.
   • DBuild separate visualizations for each log source and manually combine them on the dashboard.
   Reveal Solution Discussion Select an answer first