A financial institution must retain audit logs for at least seven years to meet regulatory requirements. The SIEM storage is expensive, and the security team wants to reduce costs without violating compliance. Which strategy is most appropriate?

Store logs in the SIEM for 90 days, then archive them to low-cost storage for the remaining period.

Keep all logs in the SIEM for seven years.

Delete logs older than 90 days to save storage space.

Reduce log verbosity to lower storage usage.

Which of the following is an example of a threshold-based correlation rule?

Alert if a firewall blocks a known malicious IP

Alert if more than 10 failed login attempts occur within 5 minutes

Alert if an antivirus detects malware on a host

Alert if a user logs in from a new geographic location

A financial institution is required by PCI DSS to retain audit logs for at least one year, with the ability to immediately access the most recent three months. The SIEM currently stores all logs for 90 days in hot storage. What should the institution do to meet the requirement?

Store only logs that contain cardholder data and delete the rest after 90 days.

Keep 90 days in hot storage and archive logs older than 90 days to a system that can retrieve them within a reasonable time.

Compress the logs and keep them in hot storage for one year.

Extend hot storage to one year for all logs.

During an incident response, an analyst discovers that the SIEM did not alert on a series of suspicious activities because the relevant logs were not being collected from a critical server. The server's logs are stored locally and are not forwarded to the SIEM. What is the most important immediate action?

Disable the SIEM's correlation rules for that server.

Increase the SIEM's storage capacity.

Configure the server to forward its logs to the SIEM immediately to capture ongoing activity.

Manually review the local logs to identify past suspicious activity.

What is the primary function of a correlation rule in a SIEM?

To store logs in a tamper-proof format

To normalize log formats from different vendors

To collect logs from remote devices

To identify patterns or sequences of events that indicate a security threat

GIAC Security Essentials

Domain 5Objective 2

Log Management & SIEM GSEC Practice Questions (Page 1)

Part of the Security Operations and Incident Response domain, which makes up ~16% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 1–5

1application · medium
A financial institution must retain audit logs for at least seven years to meet regulatory requirements. The SIEM storage is expensive, and the security team wants to reduce costs without violating compliance. Which strategy is most appropriate?
Select an answer first
2foundation · easy
Which of the following is an example of a threshold-based correlation rule?
Select an answer first
3application · medium
A financial institution is required by PCI DSS to retain audit logs for at least one year, with the ability to immediately access the most recent three months. The SIEM currently stores all logs for 90 days in hot storage. What should the institution do to meet the requirement?
Select an answer first
4expert · hard
During an incident response, an analyst discovers that the SIEM did not alert on a series of suspicious activities because the relevant logs were not being collected from a critical server. The server's logs are stored locally and are not forwarded to the SIEM. What is the most important immediate action?
Select an answer first
5foundation · easy
What is the primary function of a correlation rule in a SIEM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.