Orchestrating Log Integrations for Operational Value GCAD Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which component is essential in a log integration architecture to ensure that logs from different sources can be ingested and processed uniformly?

   • AA manual process to upload logs periodically
   • BA separate storage account for each log type
   • CA dedicated network segment for each log source
   • DA central log collector or forwarder that receives logs from multiple sources
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is an example of an actionable alert configured from log data?

   • AAn alert that normalizes log formats
   • BAn alert that stores logs in a different bucket
   • CAn alert that triggers when the number of failed login attempts exceeds a threshold
   • DAn alert that logs all successful logins
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which storage tier is most appropriate for logs that must be retained for several years but are rarely accessed?

   • APremium storage tier
   • BHot storage tier
   • CArchive storage tier
   • DCool storage tier
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When onboarding log sources for a cloud environment, which of the following is a key consideration to ensure complete coverage?

   • AOnly onboarding logs from critical production systems
   • BFocusing only on logs that are required for compliance
   • COnboarding logs only from sources that support a common format
   • DIncluding logs from cloud services, applications, and infrastructure components
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's security team is building a central SIEM. They are ingesting AWS CloudTrail, Azure Active Directory sign-in logs, and on-premises firewall logs. The team wants to detect a single user performing anomalous actions across all three sources. Which approach best enables this analysis?

   • AIngest only CloudTrail and Azure AD logs, since on-premises firewall logs are not relevant to user-centric detection.
   • BStore each log type in its original format and use the SIEM's search to manually correlate by username across sources.
   • CConvert all logs to JSON and rely on the SIEM's built-in field extraction to automatically map fields without any configuration.
   • DNormalize all logs into a common schema that preserves the user identifier, timestamp, and action fields, then enable correlation rules on those fields.
   Reveal Solution Discussion Select an answer first