Log Management & SIEM GSEC Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   A healthcare organization must retain authentication logs for at least one year to comply with HIPAA, but the SIEM storage budget only supports 90 days of hot storage. The organization also needs to respond to incidents that may be discovered months later. Which strategy best meets both compliance and operational needs?

   • ACompress the logs and keep them in the SIEM's hot storage for one year.
   • BArchive logs older than 90 days to low-cost cold storage that can be retrieved when needed.
   • CStore only failed authentication events and discard successful ones.
   • DDelete logs older than 90 days to stay within the storage budget.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A SIEM is generating too many alerts from a rule that detects port scans. The rule triggers on any 10 connections to different ports from the same source IP within 5 minutes. The SOC wants to reduce false positives caused by legitimate network scanning tools. Which approach is most effective?

   • AAdd the known scanning tool's IP addresses to an allowlist in the rule.
   • BChange the rule to alert only on TCP SYN packets.
   • CDisable the rule and rely on the firewall logs.
   • DIncrease the threshold to 100 connections within 5 minutes.
   Reveal Solution Discussion Select an answer first
3. 48foundation · easy

   During incident response, how can a SIEM assist an analyst in investigating a security alert?

   • ABy providing searchable access to historical logs and related events
   • BBy deleting malicious files from affected endpoints
   • CBy blocking the attacker's IP address on the firewall
   • DBy automatically patching the vulnerable system
   Reveal Solution Discussion Select an answer first