Log Centralization GCTD Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   An analyst is investigating a potential account takeover. They have centralized logs from the identity provider (IdP), the application, and the network. They notice that the IdP log shows a successful login from a new device, but the application log shows no subsequent activity. Which conclusion is most likely?

   • AThe application logs are incomplete and the analyst should ignore them.
   • BThe attacker used a VPN to hide their activity.
   • CThe login was a false positive and no further investigation is needed.
   • DThe attacker may have obtained valid credentials but was blocked by the application's risk-based authentication.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization centralizes logs in Elasticsearch. Analysts complain that searches for user activity are slow. The logs include a field `user_id` that is used in most queries. Which optimization will most improve search performance?

   • ACreate an index mapping that defines `user_id` as a keyword field and use it in filtered queries.
   • BDisable indexing for all fields except the raw message.
   • CIncrease the number of replicas for every index.
   • DStore all logs in a single index to avoid index overhead.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst notices a spike in failed SSH logins to a Linux VM in Azure, followed by a successful login from an unusual IP, and then a large data download from that VM. The logs are centralized in a SIEM. What is the most effective way to confirm the attack chain?

   • ACheck the Azure Activity Log for the VM's creation time to see who deployed it.
   • BRun a vulnerability scan on the VM to identify the exploited service.
   • CSearch only the VM's syslog for the successful login event and ignore other logs.
   • DCorrelate the VM's authentication logs with the VM's network security group flow logs and Azure Activity Log for the same time window.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In a centralized logging platform, what is the purpose of indexing logs?

   • ATo compress logs so they take up less storage space.
   • BTo encrypt logs to protect them from unauthorized access.
   • CTo organize log data in a way that enables fast and efficient search queries.
   • DTo delete logs that are no longer needed.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SOC uses a SIEM with a fixed indexing budget. They need to retain logs for 90 days for compliance, but they also need fast search on recent logs. They are considering a hot/warm/cold architecture. Which configuration best balances cost and search performance?

   • AKeep all logs in hot storage for 90 days to ensure fastest search.
   • BDelete logs after 30 days to reduce cost.
   • CUse hot storage for the first 7 days, warm storage for the next 30 days, and cold storage for the remaining 53 days, with search available on all tiers.
   • DUse only cold storage for all logs and accept slower search times.
   Reveal Solution Discussion Select an answer first