Log Management & SIEM GSEC Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which SIEM feature is most useful for correlating an alert with other events to determine the full scope of an incident?

   • AAutomated patch deployment
   • BNetwork traffic capture
   • CLog search and pivot capabilities
   • DReal-time dashboard
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SIEM administrator is asked to reduce the cost of log storage. The SIEM currently ingests a high volume of verbose logs from development servers that are not critical for security monitoring. However, the organization must retain security-related logs for compliance. Which approach best balances cost and compliance?

   • AFilter out non-security logs from development servers at the collection point and retain only security-relevant logs.
   • BCompress logs but keep all of them.
   • CReduce the retention period for all logs to 30 days.
   • DStop collecting logs from development servers entirely.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization has a mix of on-premises servers and cloud-based virtual machines. The security team wants a single SIEM to collect logs from both environments. What is the most efficient way to achieve this?

   • AOnly collect logs from the cloud environment.
   • BDeploy log collection agents on both on-premises servers and cloud VMs, forwarding to the central SIEM.
   • CUse separate SIEMs for on-premises and cloud environments.
   • DManually copy logs from each environment to the SIEM.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SIEM is generating a high volume of alerts from a correlation rule that flags any connection to an external IP address. The security team is overwhelmed and missing critical alerts. Which action is most effective to reduce noise while maintaining security visibility?

   • AReduce the log sources feeding the SIEM.
   • BCreate an allowlist of known benign external IPs and suppress alerts for them.
   • CDisable the correlation rule entirely.
   • DIncrease the alert severity to make it more noticeable.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SIEM correlation rule is designed to detect a potential data exfiltration by flagging when a user uploads more than 100 MB of data to an external cloud storage service within 10 minutes. The rule has generated several alerts for a marketing user who frequently shares large files. What is the best way to refine this rule?

   • ADisable the rule for the marketing department.
   • BChange the time window to 1 hour.
   • CAdd a baseline of normal user behavior and alert only when the upload volume deviates significantly from that baseline.
   • DIncrease the threshold to 500 MB to reduce alerts.
   Reveal Solution Discussion Select an answer first