Log Centralization GCTD Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial company must retain audit logs for seven years to meet regulatory requirements. They also need to ensure logs cannot be altered by an attacker who compromises the central logging server. Which storage strategy best satisfies both requirements?

   • AKeep logs on the central logging server's local disk and back them up nightly to tape.
   • BCompress logs and store them in a database with a user account that has delete permissions.
   • CStore logs in an immutable object storage bucket with versioning and a retention lock set to seven years.
   • DExport logs to a standard cloud storage bucket with lifecycle rules to delete after seven years.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A security analyst notices a failed login followed by a successful login from the same IP address, and then a large data download from a storage service. What does this sequence of events represent?

   • AA potential brute-force attack followed by data exfiltration.
   • BA false positive that can be ignored.
   • CA network misconfiguration.
   • DA normal user behavior pattern.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has a mature security operations center but is considering moving from a self-managed SIEM to a cloud-native logging service. They are concerned about losing the ability to correlate custom application logs with cloud infrastructure logs. Which approach best preserves correlation capabilities?

   • AKeep the self-managed SIEM for application logs and use the cloud-native service only for cloud logs.
   • BUse a cloud-native logging service that supports custom log ingestion and query APIs, and migrate existing custom log parsers.
   • CUse the cloud-native service for all logs but do not migrate existing dashboards or alerts.
   • DStop collecting application logs and rely only on cloud infrastructure logs.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   A cloud team needs to send application logs from a virtual machine to a centralized logging platform. Which method is commonly used for this purpose?

   • AUsing the cloud provider's API to manually upload log files on a schedule.
   • BConfiguring the VM's network security group to send logs directly to the logging platform.
   • CEnabling the VM's boot diagnostics to stream logs to the logging platform.
   • DInstalling a log agent on the VM that forwards logs to the central platform.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company runs a Kubernetes cluster in a cloud provider and wants to ship container stdout logs to a central SIEM. The SIEM requires logs to be in a specific JSON format and needs to filter out sensitive fields before transmission. Which ingestion method is most appropriate?

   • AConfigure the cloud provider's object storage to automatically replicate logs to the SIEM's storage bucket.
   • BDeploy a log shipper as a DaemonSet that reads container logs, applies a parsing and redaction pipeline, and forwards to the SIEM.
   • CUse the SIEM's built-in cloud connector to pull logs directly from the Kubernetes API server.
   • DHave each application write logs to a shared network filesystem that the SIEM can mount and read.
   Reveal Solution Discussion Select an answer first