A company is subject to a regulation that requires audit logs to be retained for at least one year, but also requires that logs be available for immediate review upon request. The company has limited storage budget. Which retention policy best meets both requirements?

Retain logs in hot storage for one year and then delete them to minimize costs.

Retain logs in hot storage for six months and then move to cold storage for six months.

Retain logs in cold storage for one year and restore them to hot storage only when a request is made.

Retain logs in a searchable hot storage for one year, then archive them to cold storage for an additional year for potential legal holds.

During an incident investigation, an analyst needs to determine whether an attacker moved laterally from a compromised workstation to a database server. Which set of log sources would provide the most definitive evidence of lateral movement?

Application logs on the database server showing SQL queries from the workstation.

Firewall logs showing traffic between the workstation and the database server.

DNS logs showing the workstation resolving the database server's hostname.

Windows event logs for logon events (4624, 4625) on the database server, combined with network connection logs from the workstation showing connections to the database server's IP and port.

A security team is designing a new audit log management program. They want to ensure that log sources are consistently configured, that retention periods are documented, and that logs are protected from tampering. Which set of actions best aligns with audit log management best practices?

Create a logging standard that specifies which events to log, configure all systems to send logs to a central SIEM, and implement hashing and access controls on the SIEM.

Retain all logs indefinitely in a low-cost storage to ensure no evidence is ever lost.

Enable logging on all systems with default settings and store logs locally for 30 days.

Use a third-party vendor to manage logs, but do not document the process because the vendor handles everything.

A company has a mix of on-premises servers and cloud-based applications. The security team wants a single view of audit logs from both environments for incident response. Which approach is the most effective?

Use the cloud provider's native logging service for both on-premises and cloud logs by installing the cloud agent on all on-premises servers.

Use a cloud-based SIEM that can ingest logs from both on-premises sources via agents or syslog and from cloud applications via their APIs.

Export cloud logs to on-premises storage and use the existing on-premises SIEM exclusively.

Maintain separate log repositories for on-premises and cloud logs, and manually combine them when an incident occurs.

GIAC Critical Controls Certification

Domain 5Objective 1

Audit Log Management GCCC Practice Questions (Page 10)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 46–49

46expert · hard
A company is subject to a regulation that requires audit logs to be retained for at least one year, but also requires that logs be available for immediate review upon request. The company has limited storage budget. Which retention policy best meets both requirements?
Select an answer first
47expert · hard
During an incident investigation, an analyst needs to determine whether an attacker moved laterally from a compromised workstation to a database server. Which set of log sources would provide the most definitive evidence of lateral movement?
Select an answer first
48application · medium
A security team is designing a new audit log management program. They want to ensure that log sources are consistently configured, that retention periods are documented, and that logs are protected from tampering. Which set of actions best aligns with audit log management best practices?
Select an answer first
49application · medium
A company has a mix of on-premises servers and cloud-based applications. The security team wants a single view of audit logs from both environments for incident response. Which approach is the most effective?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.