312-39 Log Management — 10 Questions

Question 1

You are troubleshooting a performance bottleneck in an ELK Stack deployment. Logstash is dropping events due to backpressure. Which configuration parameter in the Logstash pipeline file is best suited to manage the queue size and prevent memory overflow?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the pipeline.batch.size. pipeline.batch.size and pipeline.workers are key, but pipeline.ordered controls the processing flow and buffer behavior directly.

Answer

Set the log.level to error

Answer

Disable the Elasticsearch output plugin

Answer

Change the time_zone parameter

Question 2

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requires at least one year of retention, with at least three months of logs immediately available for analysis.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM

Question 3

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

Accepted Answer

TCP. TCP provides a three-way handshake and acknowledgment, making it more reliable than UDP for log delivery.

Answer

UDP

Answer

ICMP

Answer

ARP

Question 4

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

Accepted Answer

CloudWatch Unified Agent. The Unified CloudWatch Agent is designed to collect logs and metrics from both EC2 and on-premises servers.

Answer

Simple Queue Service (SQS)

Answer

Kinesis Firehose

Answer

AWS Config

Question 5

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Accepted Answer

Implementing TLS-based log forwarding. TLS encryption (via Syslog-ng or Rsyslog with TLS) ensures both confidentiality and integrity of the logs.

Answer

Utilizing SNMPv1 traps

Answer

Encapsulating logs in cleartext UDP packets

Answer

Using standard port 514 without encryption

Question 6

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Accepted Answer

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/. The use of macros like $HOST or $YEAR allows for dynamic directory creation based on incoming log metadata.

Answer

Defining separate log paths for every individual IP address

Answer

Configuring the global log_level to debug

Answer

Using hardcoded static path strings only

Question 7

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Accepted Answer

/etc/logrotate.conf. /etc/logrotate.conf is the primary configuration file for defining rotation schedules and behaviors.

Answer

/var/log/messages

Answer

/etc/rsyslog.conf

Answer

/etc/sysctl.conf

Question 8

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

Accepted Answer

Regular Expressions (Regex). Regular Expressions (Regex) are the industry standard for extracting specific patterns from unstructured string data.

Answer

Manual data entry

Answer

Disabling field mapping

Answer

Using a fixed-width parser

Question 9

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

Accepted Answer

Log Aggregator. The Log Aggregator (or collector) receives data, normalizes it, and routes it to storage.

Answer

End-user Workstation

Answer

Log Source

Answer

Database Engine

Question 10

Which THREE items are essential components of a robust log management policy?

Accepted Answer

Definition of log retention periods. A policy must define what to log, how to protect it, and for how long to keep it.

Answer

Default login credentials for all devices

Answer

The salary of the SOC analyst