Data Source Assessment and Collection GSOM Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security operations manager is evaluating a new data source for the SIEM: cloud API logs from a SaaS application. The vendor provides logs via a REST API with a 30-day retention window. The manager needs to ensure the logs are available for correlation with other data sources for at least 90 days to meet an internal policy. The API does not support pushing logs to the SIEM. What is the most effective approach to meet the 90-day retention requirement?

   • ARequest the vendor to increase the API retention window to 90 days.
   • BAccept the 30-day retention and adjust the internal policy to match.
   • CUse a script to periodically pull logs from the API and store them in a local data store that feeds the SIEM.
   • DUse the SIEM's built-in API connector to pull logs directly from the SaaS application.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security operations manager needs to collect DNS query logs from 200 distributed branch office firewalls. The firewalls support syslog export, SNMP, and a REST API. The organization has a limited WAN budget and wants to minimize bandwidth usage while ensuring logs are available for correlation in the SIEM. Which collection method is most appropriate?

   • AConfigure the firewalls to send syslog messages to a central collector that forwards them to the SIEM.
   • BUse SNMP traps to send DNS query logs to the SIEM.
   • CEnable SNMP polling from the SIEM to collect DNS logs on demand.
   • DUse the REST API to have the SIEM pull logs from each firewall every 5 minutes.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When defining a data retention policy, which of the following is a key operational consideration?

   • AThe brand of the log management software
   • BThe number of security analysts on staff
   • CThe color scheme of the SIEM dashboard
   • DThe storage capacity and cost of retaining data
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security operations team is designing the data collection strategy for a new cloud-based application. The application runs on virtual machines (VMs) and uses a managed database service. The team needs to ensure that they can detect unauthorized access and data exfiltration. Which combination of data sources should the team prioritize?

   • AOnly the network flow logs, as they show all traffic to and from the application.
   • BVirtual machine logs, database audit logs, and network flow logs.
   • COnly the virtual machine logs, as they contain all relevant security events.
   • DOnly the database audit logs, as they show all data access and changes.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the purpose of validating data collection in a security operations environment?

   • ATo replace the need for regular backups
   • BTo reduce the number of security alerts
   • CTo increase the volume of data collected
   • DTo ensure that the data pipeline is functioning correctly and data is not lost
   Reveal Solution Discussion Select an answer first