Log Collection and Enrichment GCDA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization needs to collect security logs from network firewalls, Windows servers, and a custom web application. The web application outputs JSON, while the firewalls support syslog. Windows servers use Event Log. What is the most efficient way to collect all these logs into a single SIEM?

   • AUse separate SIEM instances for each log type
   • BUse a universal forwarder that supports multiple input types and forwards to the SIEM
   • CConvert all logs to a single text format before collection
   • DManually copy log files to the SIEM server daily
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is reviewing an alert for a login from an IP address that is flagged as malicious by the SIEM's threat intelligence feed. The analyst needs to determine if this IP belongs to a known cloud provider or a residential ISP to assess whether the login is likely from a legitimate user. Which enrichment source should the analyst consult?

   • AAsset management database
   • BThreat intelligence feed
   • CWHOIS and IP ownership registry
   • DGeolocation database
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   Which enrichment technique involves adding external threat intelligence to a log entry?

   • ATagging with metadata
   • BCorrelating with external data
   • CParsing raw fields
   • DNormalizing timestamps
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   An analyst wants to enrich logs with information about which internal systems are critical to business operations. Which external data source should be used?

   • AGeolocation database
   • BAsset database
   • CThreat intelligence feed
   • DDNS logs
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SIEM administrator is troubleshooting why some events from a Linux server are not showing up in searches. The events are being sent via syslog, but the SIEM's parser expects a specific syslog format. The administrator suspects the events are being dropped during parsing. What should the administrator do to confirm this?

   • AIncrease the syslog rate limit on the server.
   • BCheck the SIEM's parsing error logs for events from that server.
   • CVerify the server's timezone is set correctly.
   • DReboot the SIEM collector service.
   Reveal Solution Discussion Select an answer first