Log Management & SIEM GSEC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a primary benefit of centralized logging?

   • AIt guarantees real-time alerting for all security events
   • BIt reduces the storage capacity required for logs
   • CIt eliminates the need for endpoint security software
   • DIt allows for easier correlation and analysis of events across multiple systems
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common method for collecting logs from network devices such as routers and firewalls?

   • ANetFlow
   • BSyslog
   • CWindows Event Log
   • DSNMP traps
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A retail company must centralize logs from 200 point-of-sale (POS) terminals that run a legacy embedded OS. The terminals support syslog over UDP only, and the security team needs to ensure log delivery is not lost during network congestion. The SIEM is hosted on-premises. Which approach best meets the requirement?

   • APlace a lightweight syslog relay on each POS terminal's network segment that receives UDP syslog and forwards it to the SIEM collector over TCP.
   • BUse the SIEM's API to pull logs directly from each POS terminal's log file share.
   • CConfigure the POS terminals to send syslog over UDP directly to the SIEM collector, and accept potential packet loss.
   • DInstall a SIEM agent on each POS terminal to collect logs and send them via HTTPS to the SIEM.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SIEM is ingesting 500 GB of logs per day, but 80% are verbose debug logs from a legacy application. The SOC wants to reduce storage costs and improve search performance without losing visibility into security-relevant events. What is the most effective approach?

   • ASend the legacy application logs to a separate SIEM instance.
   • BIncrease the SIEM's storage capacity and keep all logs at full verbosity.
   • CConfigure the SIEM to drop all logs from the legacy application.
   • DEnable log parsing and filtering to ingest only warning-level and above events from the legacy application.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is a common technique to reduce false positives in a SIEM?

   • AAdding exceptions for known benign activity
   • BDisabling all correlation rules
   • CStoring logs in a different format
   • DIncreasing the log retention period
   Reveal Solution Discussion Select an answer first