Audit Log Management GCCC Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An analyst is reviewing database audit logs and sees that a service account executes a large SELECT query that returns millions of rows at 2:00 AM every day. This has been happening for months. Which analysis technique would best determine if this is a security issue?

   • AImmediately block the service account because large queries at night are always malicious.
   • BCompare the query pattern to a baseline of normal behavior for that service account and investigate any deviation in timing, volume, or destination.
   • CIgnore the activity because it has been happening for months and is therefore normal.
   • DCheck the database error logs to see if the query failed.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A financial services firm must retain audit logs for seven years to meet regulatory requirements. The logs are currently stored on a high-performance SAN that is expensive to scale. The compliance team also needs to produce monthly reports from the logs for the first two years, but after that, logs are only needed for occasional legal discovery. Which storage strategy balances cost and compliance?

   • AStore logs on tape for the entire seven years because tape is the cheapest medium and can be restored when needed.
   • BMove logs older than two years to low-cost object storage with lifecycle policies that transition to archive tier, while keeping the most recent two years on the SAN for reporting.
   • CKeep all logs on the SAN for seven years to ensure the fastest possible retrieval for any legal request.
   • DDelete logs older than two years to reduce storage costs, relying on the monthly reports as evidence of compliance.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst is reviewing authentication logs and notices that a user account has successfully logged in from a new IP address at 3:00 AM, followed by a password change at 3:05 AM and a VPN connection at 3:10 AM. The user is a standard employee who works 9-to-5. Which pattern in the logs best indicates a potential account takeover?

   • AThe fact that the login occurred from a new IP address, regardless of the time or subsequent actions.
   • BThe VPN connection at 3:10 AM, because VPN connections are always suspicious at night.
   • CThe sequence of login, password change, and VPN connection from a new IP during off-hours.
   • DThe password change at 3:05 AM, because users never change passwords at night.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A multinational company has offices in three countries, each with its own data protection regulations. The security team is designing a global log collection architecture. Some regulations require that logs remain within the country of origin. Which architecture best balances compliance and operational efficiency?

   • AStore logs locally on each device and only collect them when an incident occurs.
   • BUse a cloud SIEM in a single region and rely on encryption to protect logs in transit and at rest.
   • CForward all logs to a single central repository in the company's headquarters country to simplify management.
   • DDeploy a regional log collector in each country that forwards logs to a regional storage repository, and then aggregate summaries to a global SIEM for monitoring.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which practice is considered a best practice for audit log management?

   • ADocumenting the log sources, formats, and retention policies
   • BDeleting logs as soon as they are reviewed
   • CStoring logs only on the originating device
   • DUsing the same log format for all sources without conversion
   Reveal Solution Discussion Select an answer first