GIAC Certified Detection Analyst
Domain 1Objective 1
SIEM Overview GCDA Practice Questions (Page 9)
Part of the SIEM Foundations domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~17–27 in this domain), expect 6–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)
47questions here
10free pages
8concepts
Questions 41–45
- 41
A SIEM is being deployed in a large enterprise. The team is concerned about the performance of the correlation engine as log volume grows. They want to ensure that the SIEM remains responsive. Which architectural approach is most effective?
Select an answer first - 42
Which method is commonly used to collect logs from a Linux server into a SIEM?
Select an answer first - 43
A company runs a mix of on-premises servers and cloud workloads. The security team is deploying a SIEM and needs to collect logs from all sources with minimal agent overhead. They want to avoid installing software on every endpoint. Which collection method best meets this requirement?
Select an answer first - 44
A SIEM alert fires for a possible data exfiltration. The analyst on duty is not sure if it is a true positive. What is the best next step in the incident response workflow?
Select an answer first - 45
Which SIEM component is responsible for interpreting raw log data and extracting fields into a structured format?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCDA” is a trademark of its owner, used for identification only.