Data Source Assessment and Collection GSOM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team has configured a new data collection pipeline that ingests logs from a critical application server. After a week, the team suspects that the pipeline is not collecting all logs, as some expected events are missing from the SIEM. The team wants to validate the data collection and identify the root cause. What should the team do first?

   • ARestart the collection agent on the application server to reset the pipeline.
   • BCompare the logs on the application server with the events in the SIEM to identify any gaps.
   • CCheck the SIEM's storage capacity to ensure that it is not full and dropping events.
   • DReview the SIEM's correlation rules to ensure that they are not filtering out the missing events.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations team is investigating a suspected data exfiltration incident. The team has access to firewall logs, DNS logs, and NetFlow data. During the investigation, they discover that the firewall logs only show the source and destination IP addresses and ports, while the DNS logs show the queried domain names. The NetFlow data shows the volume of traffic but not the content. The team needs to determine which specific files were transferred to an external IP address. Which data source assessment should the team make to address this gap?

   • AThe team should extend the retention period for the existing NetFlow data to ensure that the traffic volume data is available for the investigation.
   • BThe existing data sources are sufficient; the team should correlate the firewall and NetFlow data to infer the file transfer.
   • CThe team should use the DNS logs to identify the external IP address and then query the firewall logs for all traffic to that address.
   • DThe team should add a data source that captures the content of the traffic, such as a full packet capture or a proxy log that records HTTP requests and responses.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations team is building a detection strategy for a new application that uses a microservices architecture. The application is deployed on a container orchestration platform. The team wants to ensure they have visibility into the application's behavior and can detect anomalies. Which data sources should the team prioritize for this environment?

   • AOnly the network flow data, as it shows all communication between services.
   • BOnly the container runtime logs, as they contain all the details about the containers.
   • COnly the orchestration platform logs, as they show all the events related to the application.
   • DContainer orchestration platform logs, container runtime logs, and network flow data between services.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations team is defining a data retention policy for a new SIEM. The team has identified the following data types: authentication logs, network flow data, and endpoint telemetry. The team has a storage budget that allows for a total of 10 terabytes of data. The team estimates that the authentication logs will generate 1 terabyte per month, the network flow data will generate 2 terabytes per month, and the endpoint telemetry will generate 3 terabytes per month. The team wants to retain authentication logs for 12 months, network flow data for 6 months, and endpoint telemetry for 3 months. What is the total storage requirement for this policy?

   • A21 terabytes
   • B6 terabytes
   • C12 terabytes
   • D33 terabytes
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team has configured a new data collection pipeline for endpoint logs using an agent-based collector. The team wants to ensure that the pipeline is working correctly and that no logs are being lost. The team has set up a test endpoint that generates a known set of test events. What is the most effective way to validate the collection pipeline?

   • AReview the SIEM's documentation to confirm that the agent is supported.
   • BGenerate the test events on the test endpoint and verify that they appear in the SIEM with the correct content and timestamps.
   • CMonitor the network traffic between the agent and the SIEM to see if any data is being sent.
   • DCheck the agent's configuration file to ensure that it is pointing to the correct SIEM server.
   Reveal Solution Discussion Select an answer first