Data Source Assessment and Collection GSOM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security operations team is centralizing logs from multiple sources into a SIEM. They have Windows event logs, Linux syslog, and cloud API logs. The team notices that the same user login event appears with different usernames across sources (e.g., 'jdoe', 'JDOE', 'j.doe'). What is the most effective way to ensure these events can be correlated?

   • AUse a single collection agent for all sources to ensure consistent formatting.
   • BCreate a normalization rule that maps all username variations to a canonical form.
   • CIncrease the log retention period for all sources.
   • DStore the logs in separate indexes to avoid confusion.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations team needs to collect logs from a legacy network device that does not support modern APIs or agent installation. The device supports syslog export. The team wants to integrate these logs into the SIEM for correlation. What is the most appropriate collection method?

   • AManually copy logs from the device to the SIEM on a daily basis.
   • BUse a syslog collector to receive the logs and forward them to the SIEM.
   • CInstall an agent on the device to collect logs.
   • DUse SNMP to collect the logs from the device.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which data collection method requires installing software on the host system to gather telemetry?

   • AAgentless collection
   • BSyslog forwarding
   • CAPI-based collection
   • DAgent-based collection
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team needs to collect endpoint telemetry from a fleet of 5,000 workstations that are a mix of Windows, macOS, and Linux systems. The team has a centralized SIEM platform that supports both agent-based and agentless collection methods. The team wants to ensure that the collection method provides real-time data, works across all operating systems, and can capture process-level details. Which collection method should the team choose?

   • AAPI-based collection using the native APIs of each operating system to pull telemetry data into the SIEM on a scheduled basis.
   • BAgentless collection using WMI for Windows, SSH for Linux, and the built-in logging for macOS, all configured to forward logs to the SIEM.
   • CAgent-based collection using a single agent that supports all three operating systems and sends data to the SIEM in real time.
   • DA hybrid approach: use agents on Windows and macOS, and agentless collection for Linux systems.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of integrating multiple data sources into a centralized platform like a SIEM?

   • ATo replace the need for manual threat hunting
   • BTo reduce the total volume of data collected
   • CTo enable correlation and analysis across diverse data types
   • DTo eliminate the need for endpoint detection tools
   Reveal Solution Discussion Select an answer first