Log Centralization GCTD Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is designing a centralized logging solution. They want to protect logs from unauthorized modification by insiders. They are considering using a separate AWS account for log storage with strict IAM policies. Which additional control is most important to ensure log integrity?

   • AEnable S3 Object Lock in compliance mode on the log bucket.
   • BUse SSE-KMS encryption on the log bucket.
   • CStore logs in a bucket in the same account as the SIEM for simplicity.
   • DGrant all security team members full access to the log bucket for flexibility.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is designing a log ingestion pipeline for a high-volume cloud environment. They need to ensure that logs are not lost during transmission and that they can be replayed if the SIEM is temporarily unavailable. Which ingestion method is most reliable?

   • AWrite logs to a local file on each source and hope the SIEM collects them later.
   • BSend logs directly from sources to the SIEM over UDP.
   • CUse a durable message queue between the log sources and the SIEM, with a consumer that can replay messages.
   • DUse a simple HTTP POST from each source to the SIEM without retries.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is investigating a potential data exfiltration. They have logs from the corporate proxy, the cloud access security broker (CASB), and the endpoint detection and response (EDR) tool. The analyst wants to determine if a specific user uploaded a file to a cloud storage service. Which correlation approach is most effective?

   • ASearch the EDR logs for file access events and assume the upload occurred.
   • BJoin the proxy logs with the CASB logs using the user and destination URL, and then check the EDR logs for file access events.
   • CUse the CASB logs only, as they record all cloud uploads.
   • DSearch the proxy logs for the user's activity and assume the upload occurred.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is investigating a potential data breach. They have centralized logs from cloud access logs, database audit logs, and application logs. They want to identify which user accessed a specific sensitive record. Which approach is most effective?

   • ASearch only the cloud access logs for the record name.
   • BReview the application log for all errors around the time of access.
   • CCorrelate the database audit log with the application log using a common request ID or user ID.
   • DQuery the database audit log for all queries in the last month.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC team needs to detect a brute-force attack that involves multiple source IPs targeting the same user account. The logs are centralized in a SIEM. Which query or rule would best identify this pattern?

   • ASearch for all failed login events and manually review them.
   • BCreate a rule that alerts on any failed login event.
   • CCreate a correlation rule that groups failed login events by username and counts distinct source IPs exceeding a threshold.
   • DSearch for all events from a single source IP.
   Reveal Solution Discussion Select an answer first