Log Collection and Enrichment GCDA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company has a remote office with a low-bandwidth link. The SIEM is centralized at headquarters. The remote firewall generates high-volume logs, and the link is congested. The security team wants to ensure logs are collected without overwhelming the link. What is the best approach?

   • ASend all logs directly to the central SIEM over the link
   • BInstall a local collector that filters and forwards only relevant events to the central SIEM
   • CStore logs locally and ship them manually on a weekly basis
   • DUse a VPN tunnel to compress the log traffic
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security team needs to collect logs from a cloud SaaS application that does not support syslog or agent installation. The application provides a REST API that returns JSON events for the last 24 hours. The team wants to ingest these logs into the SIEM with minimal infrastructure. Which collection method should they use?

   • ASchedule a script to pull events from the API and forward them to the SIEM.
   • BConfigure the SaaS application to send syslog to the SIEM.
   • CUse a network tap to capture the API traffic.
   • DInstall a SIEM agent on the SaaS application's servers.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A SIEM engineer is designing enrichment for authentication logs. The company has a strict data residency requirement: all personal data must remain in the EU. The threat intelligence feed is hosted in the US and requires sending IP addresses for lookup. How should the engineer handle enrichment to comply with the requirement?

   • ASend the IP addresses to the US feed and rely on the vendor's privacy policy.
   • BDisable threat intelligence enrichment entirely.
   • CDeploy a locally hosted threat intelligence feed within the EU and enrich logs without sending data externally.
   • DAnonymize the IP addresses before sending them to the feed.
   Reveal Solution Discussion Select an answer first
5. 39foundation · medium

   A security analyst is configuring a SIEM to collect logs from a Windows domain controller. Which log source and type combination is most appropriate for collecting authentication events?

   • AJSON – REST API response
   • BSyslog – RFC 5424
   • CNetFlow – IPFIX
   • DWindows Event Log – XML/EVTX
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A detection engineer is integrating a new firewall that sends logs in a proprietary key=value format. The SIEM's default parser does not recognize the field names, so events arrive with the raw message stored in a single field. The team needs to search for source and destination IPs in a consistent way across all firewall vendors. What should the engineer do first?

   • AStore the raw logs unchanged and create a separate index for each firewall vendor.
   • BEnable the SIEM's automatic timestamp extraction and rely on the raw message for IP searches.
   • CCreate a custom parsing rule to extract the vendor fields into the SIEM's common information model fields.
   • DConfigure the firewall to send logs in CEF format instead of key=value.
   Reveal Solution Discussion Select an answer first