Data Source Assessment and Collection GSOM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common method for integrating data sources into a centralized platform?

   • AManually copying log files to a shared drive
   • BUsing a log forwarder to send data to the SIEM
   • CDisabling all other data sources to simplify the environment
   • DPrinting logs and storing them in a physical archive
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is integrating a new SaaS application's audit logs into its SIEM. The SaaS vendor provides logs via a REST API with a 90-day retention window. The security operations manager notices that the API returns logs with a timestamp in the vendor's local timezone, not UTC. What is the most important issue to address before relying on these logs for detection?

   • AThe logs should be stored in a separate data store to avoid mixing with other sources.
   • BThe API may not support pagination, causing incomplete data collection.
   • CThe logs may not be complete because the API only returns data for the last 90 days.
   • DThe logs need to be normalized to UTC to ensure accurate correlation with other data sources.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations manager is defining retention policies for different data types. The organization has a regulatory requirement to retain financial transaction logs for 7 years, but the SIEM's hot storage only supports 30 days. The manager needs to ensure the logs are available for audit purposes without overwhelming the SIEM. What is the most appropriate retention strategy?

   • ADisable logging for non-financial systems to reduce storage usage.
   • BKeep all logs in the SIEM for 7 years by increasing storage capacity.
   • CReduce the retention of all other logs to 7 days to make room for financial logs.
   • DStore financial transaction logs in the SIEM for 30 days, then export them to a low-cost archival storage for 7 years.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations manager has deployed a new agent-based collection solution for endpoint telemetry. After the rollout, the manager wants to verify that the collection is working correctly before relying on it for detection. Which action provides the most direct validation of the collection pipeline?

   • AGenerate a test event on an endpoint and verify it appears in the SIEM within the expected time frame.
   • BCheck that the agent is running on all endpoints using the management console.
   • CReview the SIEM's storage capacity to ensure there is enough space for incoming logs.
   • DCompare the number of endpoints with the number of agents installed.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security operations manager is designing a collection strategy for a large enterprise with 10,000 endpoints. The manager needs to collect endpoint telemetry for detection and response. The organization has a mix of Windows and Linux endpoints, and the security team has limited resources to manage the collection infrastructure. Which collection method would best balance coverage, management overhead, and data quality?

   • AUse a combination of agent-based collection for Windows and agentless for Linux.
   • BUse API-based collection from a central management console that aggregates endpoint data.
   • CUse an agentless collection method that queries endpoints via WMI and SSH.
   • DDeploy an agent-based collection solution that supports both Windows and Linux endpoints.
   Reveal Solution Discussion Select an answer first