Audit Log Management GCCC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What role do application logs play in a security architecture?

   • AThey are used exclusively for debugging during development
   • BThey replace the need for operating system logs
   • CThey only store performance metrics for capacity planning
   • DThey record application-level events such as user actions and errors that can indicate security issues
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A compliance team requires evidence that audit logs are being reviewed regularly. The security team has a SIEM that collects logs from all critical systems. Which procedure best demonstrates ongoing review and supports compliance reporting?

   • AGenerate a weekly report from the SIEM that summarizes notable events, and have a security analyst document the review and any follow-up actions.
   • BRun a monthly vulnerability scan and include the results in the compliance report.
   • CConfigure the SIEM to automatically delete logs older than 30 days to reduce storage costs.
   • DProvide the compliance team with direct read-only access to the SIEM so they can review logs themselves.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is investigating a data exfiltration incident. They have firewall logs, Windows event logs, and web proxy logs. Which combination of log sources would provide the most complete picture of the attack path from initial access to data transfer?

   • AWeb proxy logs only, because data exfiltration always goes through the web proxy.
   • BOnly Windows event logs, because they show user actions and process creation.
   • COnly firewall logs, because they show all inbound and outbound connections.
   • DFirewall logs for network connections, Windows event logs for authentication and process execution, and web proxy logs for outbound HTTP/HTTPS traffic.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is automation considered a best practice in audit log management?

   • AIt removes the need for log retention policies
   • BIt guarantees that all security incidents are prevented
   • CIt eliminates the need for any human oversight
   • DIt reduces the manual effort required for collection, correlation, and alerting
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which access control measure is essential to protect audit logs from unauthorized modification?

   • AStoring logs on the same server that generates them
   • BDisabling all logging to reduce attack surface
   • CRestricting write and delete permissions to a limited set of privileged accounts
   • DAllowing all users to read the logs for transparency
   Reveal Solution Discussion Select an answer first