Audit Log Management GCCC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security manager wants to ensure that audit log reviews are consistent and that no critical events are missed. The team currently reviews logs ad hoc. Which practice would most improve the consistency and completeness of log reviews?

   • AUse a random sampling of logs each week to get a general sense of activity.
   • BIncrease the number of analysts who have access to the log management system.
   • CCreate a documented review checklist that defines which log sources to review, the frequency, and the specific event types that require follow-up.
   • DReview logs only when an incident is reported to save time.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A multinational company needs to collect audit logs from remote offices with unreliable internet connections. The logs must be transmitted securely and must not be lost if the connection drops. Which collection method best ensures reliable and secure log delivery?

   • AHave each device send logs directly to the central SIEM over UDP to minimize overhead.
   • BInstall a local log collector at each remote office that buffers logs and forwards them over TLS to the central SIEM when the connection is available.
   • CStore logs locally on each device for 30 days and manually upload them to the central SIEM monthly.
   • DUse a VPN tunnel and send logs over syslog without buffering.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team is designing a log management system. They want to ensure that logs are tamper-proof even if an attacker gains administrative access to the log collection server. Which design is the most resilient?

   • AForward logs in real time to a separate, immutable storage system (e.g., WORM) that the collection server cannot modify or delete.
   • BUse a SIEM that hashes logs on ingestion and stores the hashes in the same database.
   • CEncrypt logs on the collection server and store the encryption keys on the same server.
   • DStore logs on the collection server's local disk and back them up daily to a network share.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A compliance audit requires that all security incidents be documented with evidence from audit logs. The security team has a SIEM that generates alerts, but the alerts do not always include the underlying log entries. The team needs to produce a report that shows the incident timeline and the supporting logs. Which process would best ensure the report is complete and accurate?

   • ARely on the SIEM's automatic alert reports, which include a summary of the event.
   • BHave analysts manually write a narrative of each incident without attaching logs, to save time.
   • CWait until the compliance audit occurs and then collect logs for all incidents from the past year.
   • DCreate a standard incident response procedure that requires analysts to attach relevant log extracts and a timeline to each incident ticket, and periodically audit a sample of tickets for completeness.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary benefit of aggregating audit logs from multiple sources into a central repository?

   • AIt enables correlation and analysis of events across the entire environment
   • BIt eliminates the need for any log retention policies
   • CIt reduces the volume of logs generated by each source
   • DIt automatically prevents all security incidents
   Reveal Solution Discussion Select an answer first