Log Centralization GCTD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is designing a central log repository. They need to ensure that logs are not tampered with and that any tampering is detectable. Which control is most effective for this purpose?

   • AStore logs in a database with a user-friendly interface for editing.
   • BGenerate a cryptographic hash of each log batch and store the hashes in a separate, write-once system.
   • CRestrict access to the log repository to only the security team.
   • DEncrypt the logs with a strong encryption key and store the key with the logs.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large enterprise uses a SIEM that supports both agent-based and agentless log collection. They have a mix of cloud VMs and SaaS applications. The security team wants to minimize the number of agents to reduce maintenance, but they also need to ensure that logs from ephemeral workloads are captured. Which ingestion strategy best balances these constraints?

   • ADeploy agents on every VM and SaaS application to ensure complete coverage.
   • BUse only agentless collection for all sources to avoid agents entirely.
   • CUse agentless API integrations for SaaS applications and deploy lightweight agents on persistent VMs, while using cloud-native log streaming for ephemeral workloads.
   • DRely on the cloud provider's built-in logging and do not integrate with the SIEM.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common method for ingesting logs from a cloud service that does not support installing an agent?

   • AModifying the service's source code to send logs directly.
   • BUsing a network packet capture to infer log data.
   • CUsing a service-to-service integration or API to export logs to the central platform.
   • DDeploying a virtual machine inside the service to run a log collector.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A company has separate teams for AWS, Azure, and on-premises infrastructure. Each team manages its own logs, and the SOC has to manually check multiple dashboards during an incident. They want to improve detection and response efficiency. What is the primary benefit of centralizing logs into a single platform?

   • AIt eliminates the need for any other security tools.
   • BIt enables correlation of events across all environments in one place, reducing investigation time.
   • CIt reduces the amount of log data generated by the cloud providers.
   • DIt automatically prevents all security incidents.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   To ensure that logs have not been tampered with after they are stored, which security control should be implemented?

   • ANetwork segmentation to isolate the logging platform.
   • BLog compression to reduce file size.
   • CLog integrity monitoring, such as hashing or write-once storage.
   • DLoad balancing to distribute log writes.
   Reveal Solution Discussion Select an answer first