Cloud Logging Fundamentals GCLD Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security engineer is designing a logging solution for a regulated environment. The solution must support real-time alerting and also provide long-term storage for compliance audits. Which architecture best meets both requirements?

   • AStream logs to a real-time analytics platform for alerting and simultaneously archive raw logs to low-cost storage
   • BStore logs only in low-cost archival storage and run alerts on archived data
   • CStore logs in a database and query them manually for alerts
   • DUse real-time analytics only and rely on backups for compliance
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is investigating a breach that occurred two months ago. The analyst needs to review logs from that period, but the current logging system only retains logs for 30 days. Which action would have prevented this problem?

   • AConfigure log archival to a separate storage service with a longer retention policy
   • BIncrease the verbosity of log messages
   • CUse a log analysis tool to compress logs
   • DEnable logging on additional sources
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is using a cloud logging solution that charges based on the volume of logs ingested. They want to reduce costs while still meeting security monitoring requirements. Which approach is most effective?

   • AFiltering out low-value logs, such as routine health checks, before ingestion
   • BDisabling logging for all non-critical services
   • CStoring logs in cold storage instead of hot storage
   • DReducing the retention period for all logs
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is investigating a possible account compromise. The analyst has access to authentication logs, network logs, and file access logs. Which sequence of log review would be most effective for understanding the attack timeline?

   • AReview all logs in random order to avoid bias
   • BReview file access logs first to see what data was stolen
   • CReview network logs first to identify all external IPs
   • DReview authentication logs first to identify the initial access, then correlate with network and file access logs
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is investigating a breach that occurred over the past week. They have enabled cloud audit logs, but they realize that the logs are only retained for 7 days. The incident was discovered on day 8. What is the most likely impact on the investigation?

   • AThe investigation is unaffected because audit logs are always retained indefinitely
   • BLogs from the first day of the breach may have been deleted, leaving a gap in the timeline
   • CAll logs are still available because the retention period starts from the end of the incident
   • DThe logs are automatically archived to cold storage after 7 days
   Reveal Solution Discussion Select an answer first