Log Centralization GCTD Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A startup uses a centralized logging platform that charges based on data ingested and stored. They want to reduce costs without losing the ability to investigate security incidents. Which strategy is most effective?

   • AIngest only error-level logs and discard all informational logs.
   • BStore all logs in hot storage for the maximum retention period.
   • CSet different retention periods for different log types, keeping security-relevant logs longer and operational logs shorter.
   • DDisable logging for non-production environments.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC team needs to search across millions of log entries for a specific user's activity over the past week. The logs are in a central logging platform. What is the most efficient way to perform this search?

   • ARun a broad search for all events and manually scroll through the results.
   • BDownload all logs from the past week and use a text editor to find the username.
   • CUse the platform's query language to search for the username with a time range filter of the past week.
   • DAsk the cloud provider to run the search on their side and share the results.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses Google Cloud Platform (GCP) and wants to centralize audit logs into their on-premises SIEM. They need to ensure logs are delivered in near real-time and are not lost if the SIEM is temporarily unavailable. Which ingestion method best meets these requirements?

   • AUse a Pub/Sub subscription to export logs from Cloud Logging and have a subscriber forward them to the SIEM.
   • BUse a scheduled Cloud Function to pull logs from Cloud Logging every hour and push them to the SIEM.
   • CExport logs to a Cloud Storage bucket daily and have the SIEM ingest the files.
   • DHave each GCP service send logs directly to the SIEM via syslog.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which factor is most important to consider when defining a log retention policy for a centralized logging platform?

   • AThe compliance and regulatory requirements that mandate how long logs must be kept.
   • BThe type of web browser used by analysts.
   • CThe number of users who have access to the logging platform.
   • DThe color scheme of the logging dashboard.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has separate logging systems for its web servers, database servers, and cloud infrastructure. The incident response team struggles to piece together the timeline of an attack. What is the primary benefit of centralizing these logs?

   • AIt eliminates the need for individual system log configurations.
   • BIt reduces the total volume of logs generated by the systems.
   • CIt enables the team to correlate events across all systems to reconstruct the attack timeline.
   • DIt automatically fixes security vulnerabilities in the systems.
   Reveal Solution Discussion Select an answer first