A SOC manager wants to enrich all network flow logs with asset ownership and criticality. The asset database is updated in real time, but the enrichment process currently uses a daily export, causing stale data for newly added assets. The team needs accurate enrichment for incident response. What is the best way to improve the enrichment accuracy?

Use the daily export but accept the staleness.

Manually update the asset database before each investigation.

Increase the frequency of the daily export to twice a day.

Switch to a real-time API lookup for asset information during enrichment.

A company runs a legacy on-premises application that writes logs to a local file in a proprietary text format. The security team wants to ingest these logs into a cloud SIEM. The application cannot be modified and no agent is approved for the host. Which collection method should the team use?

Use a lightweight forwarder on a separate server to read the file via a network share and forward it

Install a SIEM agent on the host to tail the log file

Configure the application to send syslog to the SIEM collector

Perform a packet capture on the host's network interface to reconstruct the log data

A SIEM is ingesting logs from multiple sources that use different timestamp formats (e.g., 'MM/dd/yyyy HH:mm:ss' and 'yyyy-MM-ddTHH:mm:ssZ'). What should be done to ensure consistent time-based correlation?

Normalize all timestamps to a single standard format (e.g., ISO 8601) during parsing

Store timestamps as strings and use string comparison in queries

Use the SIEM's ingestion time as the event time for all sources

Keep the original formats and convert them manually in each query

A SIEM ingests Windows Event Logs, Linux syslog, and JSON from a cloud API. Analysts complain that the same field (e.g., source IP) is named differently across sources, making queries inconsistent. What is the most effective solution?

Store raw logs and only use free-text search

Create a separate dashboard for each log source

Use a parsing and normalization layer to map all source fields into a common schema

Ask each source owner to rename their fields to match the SIEM schema

GIAC Certified Detection Analyst

Domain 1Objective 2

Log Collection and Enrichment GCDA Practice Questions (Page 4)

Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 16–20

16foundation · medium
A security team wants to collect logs from a Linux server that generates syslog messages. Which method is the most efficient for forwarding these logs to a central SIEM?
Select an answer first
17expert · hard
A SOC manager wants to enrich all network flow logs with asset ownership and criticality. The asset database is updated in real time, but the enrichment process currently uses a daily export, causing stale data for newly added assets. The team needs accurate enrichment for incident response. What is the best way to improve the enrichment accuracy?
Select an answer first
18application · medium
A company runs a legacy on-premises application that writes logs to a local file in a proprietary text format. The security team wants to ingest these logs into a cloud SIEM. The application cannot be modified and no agent is approved for the host. Which collection method should the team use?
Select an answer first
19application · medium
A SIEM is ingesting logs from multiple sources that use different timestamp formats (e.g., 'MM/dd/yyyy HH:mm:ss' and 'yyyy-MM-ddTHH:mm:ssZ'). What should be done to ensure consistent time-based correlation?
Select an answer first
20application · medium
A SIEM ingests Windows Event Logs, Linux syslog, and JSON from a cloud API. Analysts complain that the same field (e.g., source IP) is named differently across sources, making queries inconsistent. What is the most effective solution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Log Collection and Enrichment GCDA Practice Questions (Page 4)

Questions 16–20

A security team wants to collect logs from a Linux server that generates syslog messages. Which method is the most efficient for forwarding these logs to a central SIEM?

A company runs a legacy on-premises application that writes logs to a local file in a proprietary text format. The security team wants to ingest these logs into a cloud SIEM. The application cannot be modified and no agent is approved for the host. Which collection method should the team use?

A SIEM is ingesting logs from multiple sources that use different timestamp formats (e.g., 'MM/dd/yyyy HH:mm:ss' and 'yyyy-MM-ddTHH:mm:ssZ'). What should be done to ensure consistent time-based correlation?

A SIEM ingests Windows Event Logs, Linux syslog, and JSON from a cloud API. Analysts complain that the same field (e.g., source IP) is named differently across sources, making queries inconsistent. What is the most effective solution?

Keep studying — SIEM Foundations