Log Centralization GCTD Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which security measure is essential to prevent unauthorized users from reading sensitive log data in a centralized logging platform?

   • AEnabling log compression to make logs unreadable.
   • BSetting log retention to zero days.
   • CUsing a load balancer to distribute log access.
   • DImplementing role-based access control (RBAC) to restrict who can view logs.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A security team wants to detect attacks that span multiple cloud services, such as an attacker who compromises a web application and then uses its service principal to access storage. What is the primary benefit of aggregating logs from all cloud services into a central repository?

   • AIt eliminates the need for individual service-level logging.
   • BIt reduces the total volume of logs generated by cloud services.
   • CIt provides a single source of truth for security analysis and enables correlation across services.
   • DIt automatically blocks malicious activity across all cloud services.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational company operates in regions with strict data residency laws. They want to centralize logs for global threat detection but must ensure that logs from certain regions do not leave the country. Which architecture best satisfies both centralization and data residency?

   • AStore logs only in the country of origin and do not share them with any central system.
   • BUse a global SIEM but encrypt logs in transit and at rest.
   • CCentralize all logs in a single region and rely on the cloud provider's compliance certifications.
   • DDeploy regional log repositories that stay within each country and forward only metadata or non-resident data to a global SIEM.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is designing a centralized logging pipeline. They need to ensure that logs are not lost if the central SIEM is down, and they also need to prevent unauthorized access to the log data in transit. Which architecture best meets both requirements?

   • AUse a message queue (e.g., Kafka) between the log shippers and the SIEM, with TLS encryption on all connections.
   • BUse a log shipper that retries indefinitely until the SIEM is back online.
   • CSend logs directly from sources to the SIEM over TLS, and rely on the SIEM's disk to store logs.
   • DEncrypt logs at the source and send them to the SIEM without additional transport security.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A security team must retain logs for at least one year to meet a compliance requirement, but they also want to control storage costs. Which approach best balances these needs?

   • AStore all logs in hot storage for the entire year to ensure fast access.
   • BDelete logs older than 30 days to reduce costs.
   • CUse tiered storage: keep recent logs in hot storage and move older logs to cheaper archival storage.
   • DStore logs only in memory to avoid storage costs.
   Reveal Solution Discussion Select an answer first