Log Management & SIEM GSEC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   During an incident, a SIEM analyst finds that a user account was used to log into a server at 02:00, and then a file was exfiltrated via FTP at 02:05. The SIEM has logs from the authentication server and the firewall. The analyst wants to confirm that the FTP connection originated from the same user's workstation. Which data source and field would provide the most direct evidence?

   • AThe server's application logs showing the FTP username.
   • BDNS logs showing the hostname resolved by the FTP client.
   • CFirewall logs showing the source IP of the FTP connection and the authentication logs showing the source IP of the user's logon.
   • DThe SIEM's correlation rule that triggered the incident.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In a typical SIEM architecture, which component is responsible for converting raw logs from different sources into a common format?

   • AData storage layer
   • BAlerting module
   • CNormalization engine
   • DCorrelation engine
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary reason an organization must define log retention periods?

   • ATo comply with regulatory requirements and support forensic investigations
   • BTo prevent logs from being tampered with
   • CTo ensure logs are always available in real time
   • DTo reduce the amount of data stored to save costs
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company has a mix of cloud-based SaaS applications and on-premises servers. The security team wants to centralize logs from both environments into a single SIEM. The SaaS applications only provide logs via their REST APIs, while the on-premises servers support syslog. Which collection strategy should be used?

   • AConfigure the SaaS applications to send syslog to the SIEM.
   • BUse a single universal agent that can collect both syslog and API logs from all sources.
   • CInstall a SIEM agent on the SaaS applications' underlying infrastructure.
   • DUse a log shipper agent on each on-premises server to send syslog to the SIEM, and use a separate API-based collector for each SaaS application.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   During an incident, a SIEM analyst needs to determine the full scope of a data breach. The analyst has identified one compromised user account. Which combination of searches would provide the most comprehensive view of the breach?

   • ASearch for all alerts triggered in the past 30 days.
   • BSearch for all failed logins for the compromised account.
   • CSearch for all logins by the compromised account, all file accesses by that account, and all outbound data transfers from the account's source IP.
   • DSearch for all events from the compromised account's workstation IP.
   Reveal Solution Discussion Select an answer first