Audit Log Management GCCC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a common technique used to detect anomalies in audit logs?

   • ADeleting logs that appear to be normal
   • BStoring logs in a format that is difficult to read
   • CBaselining normal behavior and alerting on significant deviations
   • DReviewing logs only after an incident is confirmed
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security manager needs to implement a regular audit log review process for a mid-sized company. The company has a small security team and a high volume of logs. Which review strategy is most effective for identifying anomalies while managing the team's workload?

   • AHave analysts manually review all logs from all systems on a monthly basis.
   • BAutomate all log review with machine learning and do not perform any manual review.
   • CUse a SIEM to generate alerts for predefined rules and have analysts review alerts daily, with a weekly manual review of high-risk systems.
   • DOnly review logs when an incident is reported, to avoid wasting time on false positives.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary factor that determines the minimum retention period for audit logs?

   • AThe storage capacity of the log server
   • BThe speed of the network connection
   • CRegulatory and compliance requirements
   • DThe number of users in the organization
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise is collecting logs from thousands of endpoints. The current architecture sends all logs to a central SIEM, which is experiencing performance issues and missing events during peak hours. The security team needs to ensure no events are lost while maintaining real-time analysis. Which architecture change would best address this?

   • AIntroduce a message queue (e.g., Kafka) between endpoints and the SIEM to buffer logs, and have the SIEM consume from the queue at its own pace.
   • BReduce the number of log sources by only collecting logs from critical servers.
   • CSwitch from syslog to SNMP for log collection to reduce overhead.
   • DIncrease the SIEM's processing capacity by adding more CPU and memory.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is required to produce a monthly report for management that summarizes security events. The team has a SIEM with all logs. The report must be accurate and reproducible. Which approach is the most reliable?

   • ACreate a saved SIEM search that runs on a schedule, exports the results to a PDF, and emails it to management.
   • BHave a different analyst manually create the report each month using ad hoc queries.
   • CUse the SIEM's default dashboard and take a screenshot for the report.
   • DAsk the SIEM vendor to provide a standard report template.
   Reveal Solution Discussion Select an answer first