SIEM Integration Patterns Quiz

What you'll be asked

1. What is the primary purpose of a centralized logging architecture in a SIEM environment?
2. When deploying a log forwarder (such as Syslog-ng or Fluentd) in a distributed network, what is the main benefit of using a local collector before sending data to the SIEM?
3. Which of the following describes the 'Push' model of log ingestion for a SIEM?
4. Why is 'Log Normalization' considered a critical step in the ingestion pipeline before data reaches the SIEM correlation engine?
5. In a high-throughput environment, what is a significant risk of 'Synchronous' log forwarding where the application waits for an acknowledgement from the SIEM before proceeding?

Answers and explanations come after you submit.