A company has a mix of network devices, servers, and cloud applications. The SIEM team needs to collect logs from all these sources. Some sources support syslog, some have APIs, and some require an agent. What is the most efficient way to manage this heterogeneous collection environment?

Configure each source to send logs to a different SIEM instance to avoid conflicts.

Use a centralized collection layer that supports multiple protocols, including syslog, API-based collectors, and agent-based forwarding.

Manually copy logs from each source to the SIEM server via a shared network drive.

Convert all sources to use syslog by installing a syslog daemon on every device.

A company has a mix of legacy on-premises systems that only support syslog and modern cloud services that provide API-based log export. The SIEM must collect from both, but the legacy systems cannot be modified. What is the most effective collection strategy?

Replace all legacy systems with cloud services to simplify collection.

Use a single universal agent that supports both syslog and API protocols.

Manually export logs from cloud services and import them into the SIEM.

Use syslog collectors for legacy systems and API-based connectors for cloud services.

How do SIEM alerts typically integrate with incident response workflows?

Alerts are used only for compliance reporting

Alerts are automatically resolved without human intervention

Alerts are stored only in the SIEM and never exported

Alerts are sent to ticketing systems or SOAR platforms for further investigation

What is the primary purpose of a correlation rule in a SIEM?

To detect security threats by matching patterns across events

GIAC Certified Detection Analyst

Domain 1Objective 1

SIEM Overview GCDA Practice Questions (Page 8)

Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 36–40

36application · medium
A company has a mix of network devices, servers, and cloud applications. The SIEM team needs to collect logs from all these sources. Some sources support syslog, some have APIs, and some require an agent. What is the most efficient way to manage this heterogeneous collection environment?
Select an answer first
37foundation · easy
Which SIEM component is responsible for analyzing normalized events to identify patterns and potential security incidents?
Select an answer first
38expert · hard
A company has a mix of legacy on-premises systems that only support syslog and modern cloud services that provide API-based log export. The SIEM must collect from both, but the legacy systems cannot be modified. What is the most effective collection strategy?
Select an answer first
39foundation · easy
How do SIEM alerts typically integrate with incident response workflows?
Select an answer first
40foundation · easy
What is the primary purpose of a correlation rule in a SIEM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCDA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.