Log Management

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

What is the primary benefit of using a centralized logging server compared to local logging?

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Which TWO log types are considered critical for forensic analysis after a network intrusion?

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Which THREE items are essential components of a robust log management policy?

Which THREE factors should be considered when determining the log retention period in a SOC environment?

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?