Log Collection and Enrichment GCDA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SIEM is ingesting logs from a custom application that uses a non-standard date format. The parsing rule currently fails for some events, causing them to be dropped. The team needs to ensure all events are ingested with correct timestamps. What is the best approach?

   • AWrite a custom parser that handles the non-standard date format and test it against a sample of logs
   • BUse the SIEM's default date parser and ignore the failures
   • CSet the event time to the ingestion time for all events
   • DAsk the application team to change the date format to ISO 8601
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SIEM is receiving logs from multiple sources. The parsing pipeline is configured to extract fields like src_ip and dest_ip. However, for some events, the source IP field is empty because the original log used a different field name. What is the most effective way to handle this data-quality issue?

   • ACreate an alias or additional parsing rule to map the alternate field name to src_ip.
   • BChange the SIEM's search queries to use the raw field name instead of src_ip.
   • CManually edit each raw event to add the src_ip field.
   • DIgnore events with missing src_ip because they are not useful for detection.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team wants to enrich authentication logs with the user's risk score from an identity analytics platform. The risk score changes frequently. The team needs to ensure that the SIEM uses the most current risk score when generating alerts. What is the best approach?

   • AUse a static risk score from the user's profile
   • BLook up the risk score in real time during alert generation
   • CIgnore the risk score and use other indicators
   • DEnrich events with the risk score at ingestion time and store it
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   What is the purpose of tagging logs during enrichment?

   • ATo compress logs for storage efficiency
   • BTo delete irrelevant logs automatically
   • CTo encrypt logs for secure transmission
   • DTo add labels that facilitate searching and filtering
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company needs to collect logs from a remote office with limited bandwidth. The SIEM is centralized at headquarters. The office has a local server that can act as a collector. The team wants to minimize bandwidth usage while ensuring logs are available for real-time alerting. Which approach should they take?

   • ASend all logs to the SIEM over the WAN link.
   • BDeploy a local collector that filters and forwards only security-relevant events to the SIEM.
   • CUse a VPN tunnel to send all logs without filtering.
   • DStore logs locally and send a daily summary to the SIEM.
   Reveal Solution Discussion Select an answer first