SIEM Overview GCDA Practice Questions (Page 10)

Questions 46–47

1. 46expert · hard

   A SIEM administrator is designing an architecture for a global company with offices in multiple regions. The company requires that logs from each region be searchable in real time by analysts in any region, but also requires that each region's data remain within its own geographic boundary for compliance. Which architecture best meets these conflicting requirements?

   • AUse a single SIEM instance with collectors in each region that forward logs to the central instance, but encrypt the data in transit.
   • BDeploy a SIEM instance in each region with local collectors, and configure federated search across all instances so analysts can query data from any region while data remains stored locally.
   • CCentralize all logs in a single SIEM instance in one region and provide analysts with VPN access to that instance.
   • DHave each region store logs locally in a flat file and manually copy them to a central SIEM on a weekly basis.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following best describes the role of a SIEM in a security operations center (SOC)?

   • AIt is primarily used for storing backups of critical databases
   • BIt only collects logs from servers and does not support network device data
   • CIt replaces the need for security analysts by automatically responding to all incidents
   • DIt provides a single pane of glass for monitoring and analyzing security events across the organization
   Reveal Solution Discussion Select an answer first