hardMultiple ChoiceObjective-mapped
CCSP Practice Question: A company uses a cloud-based SIEM to aggregate…
A company uses a cloud-based SIEM to aggregate logs from multiple sources. Recently, the SIEM stopped receiving logs from a critical application server. The server is running and the application is functioning normally. The security team has verified that the log forwarder service is running on the server and the network path to the SIEM is open. Which additional step should the team take to diagnose the issue?
⚠ Common exam trap
ISC2 often tests the misconception that network-level checks (firewall, connectivity) are sufficient, when the real issue is often an application-layer misconfiguration within the log forwarder itself, which candidates overlook because they assume a 'running' service is correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inspect the log forwarder's configuration and recent log files for errors.
The most likely cause of logs not being received by the SIEM, when the server is running and the network path is open, is a misconfiguration or error within the log forwarder itself. Inspecting the forwarder's configuration (e.g., destination IP, port, protocol) and its local log files (e.g., syslog, Windows Event Forwarding logs) can reveal authentication failures, queue overflows, or parsing errors that prevent log transmission. This step directly addresses the log generation and forwarding pipeline, which is the remaining point of failure after verifying network connectivity and service status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the server's CPU and memory utilization.
Why it's wrong here
The server is running normally, so resource exhaustion is unlikely.
- ✗
Review the firewall rules between the server and the SIEM.
Why it's wrong here
Firewall rules have already been verified as open.
- ✗
Restart the SIEM collector service.
Why it's wrong here
The issue is isolated to one server, so the SIEM is likely healthy.
- ✓
Inspect the log forwarder's configuration and recent log files for errors.
Why this is correct
This directly addresses the most probable cause of misconfiguration.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.