Data Source Assessment and Collection GSOM Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security operations team is evaluating a new log source. They notice that some log entries are missing timestamps and others have timestamps in different formats. Which data quality dimension is most directly affected?

   • AConsistency
   • BTimeliness
   • CAccuracy
   • DCompleteness
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is considering how to collect logs from a legacy network device that does not support any modern logging protocols or agents. The device can only send syslog messages to a specific IP address. The team wants to integrate these logs into their SIEM. What is the most practical collection method?

   • AConfigure the device to send syslog messages to a dedicated syslog collector that forwards the logs to the SIEM.
   • BInstall an agent on the device to collect and forward the logs.
   • CUse an API provided by the device to pull logs into the SIEM.
   • DManually copy the logs from the device to the SIEM on a regular basis.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security operations team is integrating a new data source into its SIEM: endpoint telemetry from a Linux-based EDR agent. The team has already integrated Windows endpoint telemetry and network flow logs. The team notices that the Linux EDR agent sends data in a different format than the Windows agent, and the SIEM's correlation rules do not match the Linux data correctly. What is the most effective way to resolve this integration issue?

   • ACreate a parsing and normalization rule specifically for the Linux EDR data format.
   • BUse the Windows EDR agent on the Linux servers to ensure consistent formatting.
   • CStore the Linux EDR data in a separate index and create separate correlation rules.
   • DDisable the Linux EDR data source until the vendor updates the format.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations manager has implemented a new log collection pipeline for firewall logs. After a week, the manager wants to verify that the pipeline is functioning correctly. The SIEM shows a steady volume of logs, but the manager is concerned about silent data loss. Which validation method would best detect silent data loss?

   • AVerify that the firewall is still configured to send logs.
   • BCompare the number of logs received by the SIEM with the number of logs generated by the firewall.
   • CCheck the SIEM's storage capacity to ensure there is enough space.
   • DReview the SIEM's dashboard for any error messages.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations manager is designing a detection strategy for a hybrid environment with on-premises servers and cloud workloads. The manager wants to detect unauthorized access to sensitive data stored in cloud storage. Which data source would provide the most direct visibility into this activity?

   • ANetwork flow logs from the cloud provider.
   • BEndpoint telemetry from on-premises servers.
   • CDNS logs from the corporate network.
   • DCloud storage access logs.
   Reveal Solution Discussion Select an answer first