A security analyst needs to find all login failures from a specific user in the last 24 hours. Which capability of a centralized logging platform makes this query efficient?

Log retention and deletion policies.

Log indexing and search functionality.

Log encryption and access control.

A security team is designing a centralized logging solution for a healthcare organization that must comply with HIPAA. They need to ensure that only authorized personnel can access logs containing PHI and that access is auditable. Which combination of controls is most appropriate?

Use a shared access key for all analysts to simplify access management.

Store logs in a private network with no external access and allow all internal users to read them.

Implement role-based access control (RBAC) on the log repository and enable audit logging for all access to the logs.

Encrypt the logs at rest and rely on the cloud provider's default access controls.

A company must retain security logs for 10 years due to regulatory requirements. They have a limited budget and need to balance cost with the ability to respond to a subpoena that may require producing logs from any point in the retention period. Which storage approach is most appropriate?

Store logs in cold storage from day one to minimize cost.

Store all logs in hot storage for 10 years to ensure immediate retrieval.

Delete logs after 90 days to save money and rely on the cloud provider's backups.

Use hot storage for the first 90 days, then transition to cold storage with a retrieval time of several hours for the remaining period.

A SIEM platform indexes logs with a field that combines the source IP and destination IP into a single string (e.g., '192.168.1.1-10.0.0.1'). An analyst needs to find all connections from a specific source IP. What is the most efficient query approach?

Use a regex search to extract the source IP from the combined field.

Download all logs and use a script to parse the combined field.

Use a wildcard search on the combined field, such as '192.168.1.1-*'.

Re-ingest the logs with separate fields for source and destination IP to enable indexed queries.

What is the primary purpose of log correlation in a centralized logging platform?

To automatically delete logs that are not relevant.

To combine related events from multiple sources to identify threats or troubleshoot issues.

To reduce the storage size of logs by removing duplicates.

To encrypt logs so that only authorized users can read them.

GIAC Cloud Threat Detection

Domain 1Objective 2

Log Centralization GCTD Practice Questions (Page 7)

Part of the Cloud Monitoring Foundations domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

Questions 31–35

31foundation · easy
A security analyst needs to find all login failures from a specific user in the last 24 hours. Which capability of a centralized logging platform makes this query efficient?
Select an answer first
32application · medium
A security team is designing a centralized logging solution for a healthcare organization that must comply with HIPAA. They need to ensure that only authorized personnel can access logs containing PHI and that access is auditable. Which combination of controls is most appropriate?
Select an answer first
33expert · hard
A company must retain security logs for 10 years due to regulatory requirements. They have a limited budget and need to balance cost with the ability to respond to a subpoena that may require producing logs from any point in the retention period. Which storage approach is most appropriate?
Select an answer first
34expert · hard
A SIEM platform indexes logs with a field that combines the source IP and destination IP into a single string (e.g., '192.168.1.1-10.0.0.1'). An analyst needs to find all connections from a specific source IP. What is the most efficient query approach?
Select an answer first
35foundation · easy
What is the primary purpose of log correlation in a centralized logging platform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTD” is a trademark of its owner, used for identification only.