Discuss CSA CCZT Exam Topic 1 Question 2

When implementing ZTA, why is it important to collect logs from

different log sources?

ACollecting logs supports investigations, dashboard creation, and
policy adjustments.

BCollecting logs supports recording transaction flows, mapping
transaction flows, and detecting changes in transaction flows.

CCollecting logs supports change management, incident
management, visibility and analytics.

DCollecting logs supports micro-segmentation, device security, and
governance.

Suggested Answer: C

Log collection is an essential component of ZTA, as it provides the data needed to monitor, audit, and improve the security posture of the network. By collecting logs from different sources, such as devices, applications, firewalls, gateways, and policies, ZTA can support various functions, such as:

Change management: Logs can help track and document any changes made to the network configuration, policies, or resources, and assess their impact on the security and performance of the network.Logs can also help identify and revert any unauthorized or erroneous changes that may compromise the network integrity1.

Incident management: Logs can help detect and respond to any security incidents, such as breaches, attacks, or anomalies, that may occur in the network.Logs can provide the evidence and context needed to investigate the root cause, scope, and impact of the incident, and to take appropriate remediation actions2.

Visibility and analytics: Logs can help provide a comprehensive and granular view of the network activity, performance, and behavior. Logs can be used to generate dashboards, reports, and alerts that can help measure and improve the network security and efficiency.Logs can also be used to apply advanced analytics techniques, such as machine learning, to identify patterns, trends, and insights that can help optimize the network operations and security3.

Reference=

Zero Trust Architecture: Data Sources

Zero Trust Architecture: Incident Response

Zero Trust Architecture: Visibility and Analytics

Get Premium CCZT Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

17 comments · newest first

Viki 11 months ago

Wait, can logs really help with micro-segmentation? Sounds a bit off.

Jesusita 11 months ago

Definitely need logs for change management too!

Viola 11 months ago

I thought it was mainly for security compliance, not all this.

Jamal 11 months ago

Totally agree, visibility is crucial!

Weldon 11 months ago

Collecting logs is key for investigations and analytics.

Maddie 12 months ago

D mentions micro-segmentation, which is important, but I’m not convinced it captures the full scope of why we need logs.

Lonny 12 months ago

I think C covers a lot of ground with change management and visibility, which are crucial for ZTA. It sounds familiar from our practice questions.

Angelo 12 months ago

I'm not entirely sure, but I feel like B is more about transaction flows, which doesn't seem as relevant to ZTA as the other options.

Mickie 1 year ago

I remember we discussed how collecting logs can help with investigations and policy adjustments, so I think A might be the right choice.

Tambra 1 year ago

Collecting logs from various sources is crucial for ZTA to support things like change management, incident response, and overall visibility. I'll make sure to cover those use cases clearly in my response.

Peggy 1 year ago

Okay, I think I've got this. Collecting logs from different sources helps provide a more complete picture for investigations, analytics, and policy adjustments under ZTA. I'll make sure to hit those key points in my answer.

Tresa 1 year ago

Hmm, I'm a bit unsure about this one. I know logs are important for visibility and troubleshooting, but I'll need to think through how that specifically applies to ZTA.

Thurman 1 year ago

This question seems straightforward. I'll focus on understanding the key reasons why collecting logs from different sources is important for ZTA.

Elenora 1 year ago

Applying Tags doesn't seem relevant to the question, so I can rule that out. Normalization to Customer Standard could be an option, but I'm not sure if that's the essential step mentioned in the question. I'm leaning towards Normalization to the Splunk Common Information Model.

Tiara 1 year ago

Hmm, this is a tricky one. I'm not sure exactly what "CI, Security Incident, and User records" are referring to. I'll need to review those concepts before I can confidently answer this.

Portia 1 year ago

I'm a bit unsure about this one. I know the pre-processing options are important, but I'm not familiar with the Veritas eDiscovery Platform. I'll need to read through the options carefully to make the best choice.

Silvana 1 year ago

Alright, I think I've got a strategy here. I'll carefully read through each option and consider how the Renewal Pricing Method and the details about the original Quote would impact what gets pulled through to the renewal.

CSA CCZT Exam - Topic 1 Question 2 Discussion