Which factor is most likely to drive a longer retention period for security logs?

Regulatory compliance requirements

A security operations team has deployed a new log collection pipeline that forwards firewall logs to a SIEM. After two weeks, an analyst discovers that logs from one specific firewall are missing for a 4-hour window during a maintenance window. The firewall itself was not rebooted, and the SIEM shows no gap for other devices. What is the most effective way to detect such gaps proactively in the future?

Add a heartbeat message from the firewall to the SIEM and alert if the heartbeat is not received for 5 minutes.

Configure the SIEM to alert when the volume of logs from any single source drops below a baseline threshold for a defined period.

Increase the log retention period for the firewall from 30 days to 90 days.

Require the firewall administrator to manually confirm log forwarding after every maintenance window.

A security operations manager is responsible for validating the data collection pipeline for a SIEM that ingests logs from multiple sources. The manager has implemented a volume-based alerting system that triggers when the log volume from any source drops below a baseline. However, the manager is concerned that this system may not detect all types of collection failures. Which additional validation method would best complement the volume-based alerting?

Increase the frequency of volume-based alerts to every 5 minutes.

Manually verify the configuration of each data source on a weekly basis.

Review the SIEM's storage capacity on a daily basis.

Implement a heartbeat mechanism for each data source that sends a periodic message to the SIEM.

A security operations manager is designing a data retention policy for a new SIEM deployment. The organization must retain authentication logs for 12 months to meet a regulatory requirement, but the SIEM storage budget only supports 6 months of hot storage. The manager needs to ensure the authentication logs remain searchable for the full 12 months while keeping costs predictable. Which approach best meets these requirements?

Duplicate authentication logs to a separate low-cost log management platform that retains them for 12 months, while keeping only 6 months in the SIEM.

Store authentication logs in the SIEM's hot storage for 6 months, then archive them to cold storage and restore them on demand when needed for investigations.

Configure the SIEM to retain authentication logs in hot storage for 12 months and reduce retention for all other log types to 3 months.

Use a tiered storage strategy: keep authentication logs in hot storage for 6 months, then move them to a lower-cost warm storage tier that remains searchable for the remaining 6 months.

GIAC Security Operations Manager

Domain 2Objective 1

Data Source Assessment and Collection GSOM Practice Questions (Page 5)

Part of the Detection and Response Operations domain, which makes up ~49% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~25–39 in this domain), expect 5–8 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

6concepts

Questions 21–25

21foundation · easy
Which factor is most likely to drive a longer retention period for security logs?
Select an answer first
22application · medium
A security operations team has deployed a new log collection pipeline that forwards firewall logs to a SIEM. After two weeks, an analyst discovers that logs from one specific firewall are missing for a 4-hour window during a maintenance window. The firewall itself was not rebooted, and the SIEM shows no gap for other devices. What is the most effective way to detect such gaps proactively in the future?
Select an answer first
23expert · hard
A security operations manager is responsible for validating the data collection pipeline for a SIEM that ingests logs from multiple sources. The manager has implemented a volume-based alerting system that triggers when the log volume from any source drops below a baseline. However, the manager is concerned that this system may not detect all types of collection failures. Which additional validation method would best complement the volume-based alerting?
Select an answer first
24application · medium
A security operations manager is designing a data retention policy for a new SIEM deployment. The organization must retain authentication logs for 12 months to meet a regulatory requirement, but the SIEM storage budget only supports 6 months of hot storage. The manager needs to ensure the authentication logs remain searchable for the full 12 months while keeping costs predictable. Which approach best meets these requirements?
Select an answer first
25foundation · easy
When assessing a data source for use in detection and response, which characteristic ensures that the data is available for analysis soon after the event occurs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOM” is a trademark of its owner, used for identification only.

Data Source Assessment and Collection GSOM Practice Questions (Page 5)

Questions 21–25

Which factor is most likely to drive a longer retention period for security logs?

When assessing a data source for use in detection and response, which characteristic ensures that the data is available for analysis soon after the event occurs?

Keep studying — Detection and Response Operations