A security analyst is reviewing firewall logs and sees an outbound connection to an IP address in a foreign country. The analyst wants to determine if this IP is associated with known malicious activity and whether the asset is a critical server. Which enrichment sources should be used?

Geolocation database and DNS logs

Threat intelligence feed and asset database

Vulnerability scanner and patch management system

A security team must collect logs from a legacy industrial control system (ICS) that only supports syslog over UDP. The SIEM is on a different network segment, and the team is concerned about log loss and spoofing. They also need to maintain a forensic chain of custody. Which approach best addresses these concerns?

Install a SIEM agent on the ICS device.

Use a syslog collector on the ICS network that receives UDP and forwards over TCP/TLS to the SIEM, with a local buffer.

Use a network tap to capture the syslog traffic.

Configure the ICS device to send syslog directly to the SIEM over UDP.

A cloud-based SaaS application only exposes an API for retrieving audit logs. The security team needs to ingest these logs into the SIEM on a continuous basis. Which collection method is most appropriate?

Use a scheduled API pull that retrieves new audit logs and forwards them to the SIEM

Configure the SaaS application to send syslog to the SIEM

Perform a network capture of the API traffic to reconstruct logs

Install an agent on the SaaS provider's infrastructure

GIAC Certified Detection Analyst

Domain 1Objective 2

Log Collection and Enrichment GCDA Practice Questions (Page 9)

Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 41–44

41foundation · medium
Which external data source is commonly used to enrich logs with the geographic location of an IP address?
Select an answer first
42application · medium
A security analyst is reviewing firewall logs and sees an outbound connection to an IP address in a foreign country. The analyst wants to determine if this IP is associated with known malicious activity and whether the asset is a critical server. Which enrichment sources should be used?
Select an answer first
43expert · hard
A security team must collect logs from a legacy industrial control system (ICS) that only supports syslog over UDP. The SIEM is on a different network segment, and the team is concerned about log loss and spoofing. They also need to maintain a forensic chain of custody. Which approach best addresses these concerns?
Select an answer first
44application · medium
A cloud-based SaaS application only exposes an API for retrieving audit logs. The security team needs to ingest these logs into the SIEM on a continuous basis. Which collection method is most appropriate?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.

Log Collection and Enrichment GCDA Practice Questions (Page 9)

Questions 41–44

Which external data source is commonly used to enrich logs with the geographic location of an IP address?

A security analyst is reviewing firewall logs and sees an outbound connection to an IP address in a foreign country. The analyst wants to determine if this IP is associated with known malicious activity and whether the asset is a critical server. Which enrichment sources should be used?

A cloud-based SaaS application only exposes an API for retrieving audit logs. The security team needs to ingest these logs into the SIEM on a continuous basis. Which collection method is most appropriate?

Keep studying — SIEM Foundations