hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Uses a siem to collect logs from multiple sources
An organization uses a siem to collect logs from multiple sources. The security team notices that some events are missing during peak traffic hours. Analysis shows that the log sources are sending data via UDP. What is the most likely cause?
⚠ Common exam trap
The trap here is that candidates may incorrectly attribute missing events to storage or bandwidth issues, but the question specifically highlights UDP as the transport, which directly implies packet loss due to the protocol's lack of reliability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
UDP packet loss
UDP is a connectionless, best-effort transport protocol that does not guarantee delivery. During peak traffic hours, network congestion can cause UDP datagrams to be dropped without any retransmission mechanism, leading to missing events in the SIEM. This is the most direct and likely cause given the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Clock skew between sources and SIEM
Why it's wrong here
Clock skew primarily affects the accurate timestamping and correlation of events within a SIEM, leading to logs appearing out of sequence or making forensic analysis challenging. While it can hinder the effective use of SIEM data for incident response and anomaly detection, it does not inherently cause the physical loss or non-transmission of log events from the source systems to the SIEM. The events are still sent and received, just with potentially incorrect timestamps relative to each other.
- ✗
Insufficient SIEM storage capacity
Why it's wrong here
Insufficient SIEM storage capacity would primarily impact the system's ability to retain historical log data or index new events for search and analysis once they have been successfully received. While severe storage constraints could eventually lead to the SIEM dropping new events if its ingestion queues overflow due to an inability to write to disk, the immediate cause of events being missing during transmission from the source is not a storage capacity problem. Transmission occurs independently of the SIEM's long-term storage capabilities.
- ✓
UDP packet loss
Why this is correct
UDP (User Datagram Protocol) is a connectionless protocol that offers no guarantees of delivery, ordering, or duplicate protection. When log events are transmitted via UDP, packets can be dropped by network devices or the receiving SIEM without any notification to the sender, and there are no built-in mechanisms for retransmission. This inherent unreliability makes UDP packet loss a direct and common cause for missing log events within a SIEM system, as the sender is unaware of the loss.
- ✗
Network bandwidth saturation
Why it's wrong here
Network bandwidth saturation can indeed lead to packet drops as network devices discard traffic when their buffers overflow, potentially impacting log transmission. However, this is a symptom of network congestion, whereas UDP packet loss is an inherent characteristic of the protocol itself, regardless of network load. While saturation can exacerbate packet loss, the fundamental unreliability of UDP makes it a more direct and consistent reason for missing events compared to a fluctuating condition like network saturation.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.