hardMultiple Choice
200-201 Practice Question: During a security incident, a SOC analyst finds…
During a security incident, a SOC analyst finds that the SIEM is not receiving logs from a critical firewall due to a network issue. The analyst needs to ensure that no alerts are missed during the outage. What should the analyst do?
⚠ Common exam trap
Cisco often tests the misconception that restarting services or manual monitoring can compensate for a network outage, when the correct approach is to leverage local log queuing or buffering on the source device to prevent data loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the firewall to queue logs locally and forward when connectivity is restored.
Configuring the firewall to queue logs locally ensures that log data generated during the network outage is stored in a local buffer (often using syslog buffering or a local log file) and automatically forwarded once connectivity to the SIEM is restored. This prevents any gap in security monitoring and ensures that all alerts are captured for analysis, even during transient network failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restart the SIEM collector service.
Why it's wrong here
Restarting the collector service does not restore the underlying network path, so logs from the firewall remain undelivered and the gap persists. Service restarts suit a crashed or hung collector process, not a connectivity failure between firewall and SIEM.
- ✗
Manually monitor the firewall console.
Why it's wrong here
Watching the console only surfaces events a human happens to see in real time; it captures no historical data for correlation, so alerts triggered by multi-source patterns are missed. Console monitoring suits short outages on low-volume devices, not a critical firewall feeding correlated detections.
- ✓
Configure the firewall to queue logs locally and forward when connectivity is restored.
Why this is correct
Local queuing preserves log events generated during the outage, then forwards them once connectivity returns, so the SIEM receives the missing data and no alerts are missed. This directly satisfies the stem's requirement to avoid gaps during the network issue.
- ✗
Ignore the gap because logs are not critical.
Why it's wrong here
Discarding the gap leaves the outage undetected, so firewall events generating alerts during that window are lost entirely. Log ingestion is the SIEM's detection input, not an optional feed. Ignoring gaps is tempting when triaging low-value noise sources, but a critical firewall warrants continuity, not dismissal.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.