Log Management & SIEM GSEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is deploying a SIEM and needs to collect logs from cloud-based applications that do not support syslog. The applications provide REST APIs for accessing their logs. Which collection method should the SIEM use?

   • AManually export logs and upload them to the SIEM.
   • BInstall an agent on the cloud application servers.
   • CConfigure the applications to send syslog to the SIEM.
   • DUse API-based collectors to pull logs from the applications.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common regulatory standard that specifies log retention requirements?

   • AISO 27001
   • BPCI DSS
   • CCOBIT
   • DITIL
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SIEM is receiving logs from multiple sources with different timestamp formats (e.g., epoch, ISO 8601, and vendor-specific). An analyst wants to create a correlation rule that relies on accurate time sequencing. What is the most important step to ensure the rule works correctly?

   • ACreate separate correlation rules for each timestamp format.
   • BManually adjust each log source's timezone settings.
   • CUse the SIEM's ingestion time instead of the log's original timestamp.
   • DNormalize all timestamps to a single standard format (e.g., UTC ISO 8601) during parsing.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A multinational company must comply with both GDPR and local data residency laws. GDPR requires that personal data be protected, and the local law requires that certain logs remain within the country's borders. The company currently stores all logs in a SIEM hosted in a neighboring country. What is the most appropriate action?

   • ADeploy a SIEM instance in the required country and route logs subject to residency requirements to that instance.
   • BEncrypt all logs and continue storing them in the neighboring country.
   • CStop collecting logs that are subject to the residency requirement.
   • DUse a cloud SIEM provider that promises to store data in the required country.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SIEM receives logs from different vendors that use varying timestamp formats and field names for the same event. An analyst wants to correlate login failures across all sources. What is the first step to enable effective correlation?

   • ANormalize the logs into a common schema with standardized fields and timestamp format.
   • BCreate a correlation rule that searches for the string 'login failed' in raw logs.
   • CManually review each log source to identify login failures.
   • DIncrease the storage capacity to hold all raw logs.
   Reveal Solution Discussion Select an answer first