Log Management

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

Which THREE items are essential components of a robust log management policy?

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

What is the primary benefit of using a centralized logging server compared to local logging?

Which TWO log types are considered critical for forensic analysis after a network intrusion?

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?