Log Centralization GCTD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is centralizing logs from multiple cloud accounts into a single SIEM. They are concerned about an attacker who compromises the SIEM admin account and tries to delete or alter logs to cover their tracks. Which control is most effective at detecting such tampering?

   • AEnable write-once-read-many (WORM) storage for the raw log archive and maintain a separate hash chain of log entries.
   • BRestrict SIEM admin access to read-only permissions.
   • CStore logs in a separate cloud account with no network access.
   • DEncrypt the logs at rest with a customer-managed key.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A startup uses a central SIEM for security monitoring. They want to reduce storage costs while still being able to investigate incidents that occurred up to a year ago. Which retention strategy is most cost-effective?

   • ACompress logs and store them only in the SIEM's cache for one year.
   • BStore all logs in hot indexes for one year to ensure immediate search performance.
   • CDelete logs older than 30 days to minimize storage costs.
   • DKeep hot indexes for 30 days and archive older logs to low-cost object storage with the ability to rehydrate when needed.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company runs a containerized application on Amazon ECS with Fargate. The security team wants to centralize container stdout logs into their existing self-managed Elasticsearch cluster. They need a solution that requires minimal operational overhead and does not require managing additional servers. Which approach should they choose?

   • ARun a sidecar container in each ECS task that tails the Docker log files and sends them to Elasticsearch.
   • BConfigure the ECS agent to write logs directly to an S3 bucket and use an S3 trigger to index them into Elasticsearch.
   • CUse Amazon CloudWatch Logs as the only destination and have analysts query logs there.
   • DEnable the awsfirelens log driver on the ECS task definition to forward logs to a Fluent Bit endpoint that ships them to Elasticsearch.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A DevOps team wants to centralize logs from serverless functions that run for only a few seconds. The functions write logs to the cloud provider's logging service. Which ingestion method is most efficient for getting these logs into the central SIEM?

   • AConfigure the cloud logging service to stream logs to a central log bus, which then forwards them to the SIEM.
   • BInstall a log agent inside each serverless function to send logs directly to the SIEM.
   • CUse a scheduled job to periodically export logs from the cloud logging service to the SIEM.
   • DHave each function write logs to a local file that is collected by a central agent.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC analyst needs to find all failed login attempts across Windows Event Logs, Linux auth logs, and cloud sign-in logs within the last hour. The logs are centralized in a SIEM. Which approach will yield the fastest and most accurate results?

   • AExport all logs to CSV files and use a text editor to search for 'failed'.
   • BUse the SIEM's dashboard to view only the most recent 100 events from each source.
   • CRun a single search across all log sources using a normalized field for the event outcome and a time filter of the last hour.
   • DSearch each log source separately and manually combine the results in a spreadsheet.
   Reveal Solution Discussion Select an answer first