hardMultiple ChoiceObjective-mapped
200-201 Practice Question: During a security incident, a SOC analyst finds…
During a security incident, a SOC analyst finds that the SIEM is not receiving logs from a critical firewall due to a network issue. The analyst needs to ensure that no alerts are missed during the outage. What should the analyst do?
⚠ Common exam trap
Cisco often tests the misconception that restarting services or manual monitoring can compensate for a network outage, when the correct approach is to leverage local log queuing or buffering on the source device to prevent data loss.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the firewall to queue logs locally and forward when connectivity is restored.
Configuring the firewall to queue logs locally ensures that log data generated during the network outage is stored in a local buffer (often using syslog buffering or a local log file) and automatically forwarded once connectivity to the SIEM is restored. This prevents any gap in security monitoring and ensures that all alerts are captured for analysis, even during transient network failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restart the SIEM collector service.
Why it's wrong here
Restarting the collector does not address the network issue or recover lost logs.
- ✗
Manually monitor the firewall console.
Why it's wrong here
Manual monitoring is impractical for a critical firewall and may miss events.
- ✓
Configure the firewall to queue logs locally and forward when connectivity is restored.
Why this is correct
Queuing ensures logs are not lost and can be sent later, preserving visibility.
- ✗
Ignore the gap because logs are not critical.
Why it's wrong here
Ignoring gaps could result in missed detection of attacks.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.