A DevOps team is deploying a microservices application. They need to ensure that logs from all services are available for troubleshooting and security analysis. Which logging practice is most important to implement?

Centralized log aggregation with a consistent log format

Logging only error-level messages

Rotating logs daily without archival

Local log storage on each service instance

A cloud security team is implementing a logging solution for a containerized application. The team needs to capture logs from containers that are frequently created and destroyed. Which approach ensures logs are not lost when containers terminate?

Store logs only within the container's local filesystem

Rely on the container orchestration platform's default logging

Configure containers to stream logs to a centralized logging service in real time

Manually copy logs from each container before deletion

A cloud security team is designing a centralized logging solution. They must ensure that logs from virtual machines, containerized workloads, and cloud service APIs are all available for security monitoring. Which approach best addresses the need to collect logs from these diverse sources?

Store logs locally on each source and access them individually during investigations

Use a single agent installed on one VM to collect logs from all other sources

Configure each source to forward logs to a centralized log management platform

Enable logging only for the cloud service APIs because they cover all activity

A security team is designing a logging architecture for a multi-cloud environment (AWS and Azure). They need to correlate security events across both clouds. Which approach is most effective?

Exporting logs to a shared storage bucket without a central analysis tool

Using only the cloud provider's native monitoring tools

Streaming logs from both clouds to a centralized SIEM platform

Storing logs separately in each cloud and manually comparing them during incidents

A security analyst is correlating events from multiple sources to identify the root cause of a service outage. Which combination of log types would provide the most comprehensive view?

Application logs, system logs, and network logs

GIAC Cloud Security Essentials

Domain 6Objective 1

Cloud Logging Fundamentals GCLD Practice Questions (Page 1)

Part of the Logging and Incident Response domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

1concept

Questions 1–5

1application · medium
A DevOps team is deploying a microservices application. They need to ensure that logs from all services are available for troubleshooting and security analysis. Which logging practice is most important to implement?
Select an answer first
2expert · hard
A cloud security team is implementing a logging solution for a containerized application. The team needs to capture logs from containers that are frequently created and destroyed. Which approach ensures logs are not lost when containers terminate?
Select an answer first
3application · medium
A cloud security team is designing a centralized logging solution. They must ensure that logs from virtual machines, containerized workloads, and cloud service APIs are all available for security monitoring. Which approach best addresses the need to collect logs from these diverse sources?
Select an answer first
4expert · hard
A security team is designing a logging architecture for a multi-cloud environment (AWS and Azure). They need to correlate security events across both clouds. Which approach is most effective?
Select an answer first
5application · medium
A security analyst is correlating events from multiple sources to identify the root cause of a service outage. Which combination of log types would provide the most comprehensive view?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.