Security Event and Incident Logging GNFA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A small financial firm needs to centralize logs from Windows servers, Linux servers, and a Cisco ASA firewall. They have a limited budget and want to minimize the number of agents deployed. Which approach best meets these requirements?

   • AInstall a third-party agent on every host and the firewall to ensure uniform log format and transport.
   • BEnable Windows Event Forwarding (WEF) to a collector and configure the ASA to send logs to that collector, but leave Linux logs local.
   • CUse a central SIEM that pulls logs via API from each device without any agents or forwarding.
   • DConfigure syslog forwarding from the ASA and Linux hosts, and install a Windows agent on the Windows servers to forward to a central syslog server.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is implementing a logging strategy for a new cloud-based application. They must meet a compliance requirement to retain logs for 3 years, but they also need to respond quickly to incidents. The application generates a high volume of logs. Which strategy best balances cost, compliance, and operational needs?

   • AStore all logs in hot storage for 3 years to ensure immediate access.
   • BStream logs to a hot analytics platform for 30 days, then archive to cold storage for the remaining retention period.
   • COnly retain logs that match alert rules for 3 years.
   • DCompress logs and store them in a single tier for 3 years.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of log aggregation?

   • ATo delete logs that are no longer needed
   • BTo generate alerts for every logged event
   • CTo combine logs from multiple sources into a central repository for analysis
   • DTo compress logs to save storage space
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which factor is most important when determining how long to retain security logs?

   • AThe storage capacity of the log server
   • BThe speed of the network connection
   • CRegulatory and compliance requirements
   • DThe number of users in the organization
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is deploying a new log aggregation solution. They need to ensure that logs are not lost if the central collector is unavailable. Which configuration should they implement?

   • AConfigure all sources to send logs using UDP to the central collector.
   • BSet the central collector to listen on multiple ports to increase capacity.
   • CIncrease the log rotation interval on the sources to keep logs longer.
   • DUse a message queue or buffer on the sending side to store logs temporarily and forward them when the collector is available.
   Reveal Solution Discussion Select an answer first