Log Management & SIEM GSEC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of log management in a security operations context?

   • ATo automatically block malicious IP addresses based on log entries
   • BTo collect, store, and analyze log data to support security monitoring, incident response, and compliance
   • CTo replace the need for intrusion detection systems by providing raw network traffic
   • DTo store logs for the longest possible time regardless of storage cost
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A multinational company must comply with both GDPR and local data residency laws that require personal data to remain within the country of origin. The company currently sends all logs to a SIEM hosted in a neighboring country. What is the most appropriate action to meet both requirements?

   • ADeploy separate SIEM instances in each country, with logs stored locally and only aggregated metadata sent to the central SIEM.
   • BEncrypt all logs before sending them to the central SIEM.
   • CMove the central SIEM to a cloud region located within the country that has the strictest data residency law.
   • DDeploy a local SIEM collector in each country that filters out personal data before forwarding logs to the central SIEM.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SIEM is ingesting logs from 1,000 devices, but the correlation engine is taking too long to process events, causing alerts to be delayed by several minutes. The team has already reduced the number of correlation rules. Which additional measure would most effectively improve performance?

   • AReduce the log retention period to 30 days.
   • BIncrease the SIEM's processing capacity by adding more CPU and memory to the correlation engine.
   • CDisable all correlation rules and rely on manual searches.
   • DSend all logs to a secondary SIEM for correlation.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of log normalization in a SIEM?

   • ATo delete irrelevant log entries automatically
   • BTo compress log files to save storage space
   • CTo encrypt logs to protect confidentiality
   • DTo convert raw log data into a consistent, structured format
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an incident investigation, an analyst finds that the SIEM has an alert for a suspicious PowerShell command on a workstation. To determine the scope of the compromise, which additional data source would be most useful?

   • AThe user's email calendar.
   • BNetwork flow logs to identify connections to known malicious IPs.
   • CThe workstation's local event log only.
   • DThe SIEM's correlation rules configuration.
   Reveal Solution Discussion Select an answer first