Cloud Logging Fundamentals GCLD Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is required to retain logs for a minimum of one year for compliance. They are using a cloud logging service that stores logs in a storage bucket. What is the most important consideration for meeting this requirement?

   • AEnabling verbose logging for all services
   • BUsing a separate bucket for each log type
   • CConfiguring a lifecycle policy to prevent deletion before one year
   • DExporting logs to a local server daily
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a core component of cloud logging that represents the origin of log data, such as a virtual machine, container, or cloud service?

   • ALog sink
   • BLog analytics workspace
   • CLog source
   • DLog retention policy
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst needs to reconstruct the sequence of actions taken by a compromised user account during a 48-hour period. The cloud environment uses a centralized logging pipeline that ingests authentication logs, API call logs, and virtual machine guest OS logs. Which combination of log types is essential for this reconstruction?

   • AGuest OS security logs and DNS query logs
   • BAuthentication logs and network flow logs only
   • COnly API activity logs and network flow logs
   • DAuthentication logs, API activity logs, and guest OS security logs
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is investigating a potential insider threat. The analyst has access to authentication logs, file access logs, and email logs. The analyst needs to determine whether a user accessed sensitive files and then sent them externally. Which combination of logs is essential for this investigation?

   • AAuthentication logs and file access logs
   • BAuthentication logs alone
   • CEmail logs and authentication logs
   • DFile access logs and email logs
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a suspected brute-force attack against a web application. The application runs on a single virtual machine and writes authentication failures to a local log file. The analyst needs to correlate these failures with network-level connection attempts and user account activity. Which combination of log sources should the analyst prioritize?

   • AOnly application logs, because they contain the authentication failure details
   • BHost operating system logs and database logs, but not application logs
   • CApplication logs, host operating system logs, and network flow logs
   • DNetwork flow logs and DNS logs, but not host logs
   Reveal Solution Discussion Select an answer first