I85PREP
⌘ K
LogRhythm LRSA study materials
LogRhythm LRSA study resources

LogRhythm LRSA practice questions

One question at a time. Build your LogRhythm LRSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1LogRhythm SIEM Platform Administration

In LogRhythm, which component is responsible for collecting and normalizing log data from remote sources before forwarding it to the Data Processor?

  1. Platform Manager
  2. Data Indexer
  3. Alarm Rule Engine
  4. System Monitor Agent Correct answer.

Explanation

The System Monitor Agent (also called the LogRhythm Agent) runs on or near the log source, collects raw data, applies log source parsing and normalization, and forwards the processed events to a Data Processor. The Platform Manager is a management and configuration service, not a collection point.

Question 2LogRhythm SIEM Platform Administration

Which LogRhythm deployment role receives events from System Monitor Agents, applies parsing and enrichment, and writes them to the Data Indexer?

  1. Mediator
  2. Admin Client
  3. AI Engine
  4. Data Processor Correct answer.

Explanation

The Data Processor is the processing tier: it receives event streams from Agents (and other collection methods), performs parsing, normalization, and metadata enrichment, then passes data to the Data Indexer for storage. The AI Engine performs correlation and analytics on already-processed data.

Question 3LogRhythm SIEM Platform Administration

A log source is sending events that arrive in the LogRhythm Web Console but are not being parsed into the expected fields. Which configuration element most directly determines how raw messages are broken into normalized fields for that source?

  1. The Data Indexer retention policy
  2. The Platform Manager license file
  3. The Alarm Rule threshold setting
  4. The Log Source Type's parsing and message definition Correct answer.

Explanation

Parsing behavior is driven by the Log Source Type, which defines the message processing and field extraction rules used to normalize raw text into structured fields. Retention policy, licensing, and alarm thresholds do not affect how individual messages are parsed.

Question 4LogRhythm SIEM Platform Administration

What is the primary purpose of a LogRhythm Log Source Type?

  1. To assign a physical storage volume to collected events
  2. To define the parsing and normalization logic applied to a category of log-generating devices Correct answer.
  3. To set the maximum event rate a Data Processor will accept
  4. To schedule automated backup jobs for the Platform Manager

Explanation

A Log Source Type represents a class of device or application and carries the parsing definitions and normalization mappings used to convert its raw logs into LogRhythm's common event schema. It is separate from storage, backup, and rate-limiting configuration.

Question 5LogRhythm SIEM Platform Administration

An administrator needs to search for events from a specific host over the last 24 hours in the LogRhythm Web Console. Which capability provides this ad hoc investigation?

  1. The Log Source inventory report
  2. Search and investigate on indexed data in the Web Console Correct answer.
  3. The Platform Manager service console
  4. The Agent configuration file editor

Explanation

The Web Console provides search and investigation tools that query indexed data, allowing filters such as host and time range to retrieve relevant events. Inventory reports, agent config files, and service consoles do not provide ad hoc event search.

Question 6LogRhythm SIEM Platform Administration

Which LogRhythm component evaluates correlation rules against processed events to raise alarms?

  1. System Monitor Agent
  2. Platform Manager
  3. AI Engine Correct answer.
  4. Data Indexer

Explanation

The AI Engine (Analytics and Intelligence Engine) applies correlation rules, risk-based analytics, and alarm generation logic to processed event streams. Agents collect, the Indexer stores, and the Platform Manager administers, but none of these perform rule-based correlation.

Question 7LogRhythm SIEM Platform Administration

An analyst wants an alarm to trigger only when five failed logons for the same user occur within ten minutes. Which LogRhythm mechanism is designed for this kind of multi-event condition?

  1. A correlation rule with a time-based grouping condition Correct answer.
  2. A Platform Manager license update
  3. A Data Indexer retention rule
  4. A log source parsing override

Explanation

Correlation rules in the AI Engine can group multiple events by a common field (such as user) within a defined time window and fire an alarm when a threshold is met. Parsing, retention, and licensing settings do not implement multi-event threshold logic.

Question 8LogRhythm SIEM Platform Administration

What does normalization accomplish for events entering the LogRhythm platform?

  1. It maps vendor-specific fields into a common schema so events can be searched and correlated consistently Correct answer.
  2. It assigns each event to a specific Data Indexer shard
  3. It encrypts events in transit between Agent and Data Processor
  4. It compresses raw logs to reduce storage consumption

Explanation

Normalization translates disparate vendor field names and formats into LogRhythm's common event schema, enabling consistent search, reporting, and correlation across heterogeneous sources. Compression, transport encryption, and shard assignment are separate concerns.

Question 9LogRhythm SIEM Platform Administration

Which LogRhythm object is used to group log sources for the purpose of applying common settings and access scoping?

  1. Entity Correct answer.
  2. Data Indexer
  3. Mediator
  4. Alarm Rule

Explanation

Entities are organizational containers in LogRhythm used to group log sources, users, and other objects so that settings, permissions, and visibility can be scoped consistently. Indexers, Mediators, and Alarm Rules serve different technical purposes.

Question 10LogRhythm SIEM Platform Administration

An administrator must ensure that a critical log source keeps sending events even if its primary Data Processor fails. Which LogRhythm capability addresses this requirement?

  1. Data Indexer retention policies
  2. High Availability with Mediator-managed failover Correct answer.
  3. Log source parsing overrides
  4. Alarm suppression rules

Explanation

LogRhythm High Availability uses Mediators to coordinate failover so that collection and processing continue on a secondary node if the primary fails. Parsing overrides, retention, and alarm suppression do not provide node-level redundancy.

Question 11LogRhythm SIEM Platform Administration

What is the function of the LogRhythm Data Indexer?

  1. To manage user authentication for the Web Console
  2. To evaluate correlation rules and raise alarms
  3. To collect raw logs from endpoints
  4. To store and index processed events so they can be searched and reported on Correct answer.

Explanation

The Data Indexer stores processed event data in an indexed form that supports fast search, reporting, and investigation. Collection is done by Agents, correlation by the AI Engine, and authentication by platform identity services.

Question 12LogRhythm SIEM Platform Administration

A new firewall model is not recognized by LogRhythm and its logs arrive unparsed. What is the most appropriate first step to enable proper parsing?

  1. Increase the Data Indexer retention period
  2. Identify or create a matching Log Source Type with appropriate message definitions and assign it to the log source Correct answer.
  3. Disable the correlation rules for that entity
  4. Move the log source to a different Entity

Explanation

Parsing depends on the Log Source Type assigned to the log source; if no type matches the device's format, the administrator must select a compatible type or build custom message definitions. Retention, correlation, and entity placement do not change parsing.

Question 13LogRhythm SIEM Platform Administration

Which LogRhythm feature allows an administrator to define reusable logic that classifies events by severity, threat, and identity before correlation?

  1. Data Indexer sharding
  2. Processing and enrichment policies applied during Data Processor processing Correct answer.
  3. Mediator heartbeat monitoring
  4. Platform Manager license enforcement

Explanation

During processing, the Data Processor applies enrichment and classification logic (such as severity, threat level, and identity mapping) that prepares events for search and correlation. Sharding, heartbeat monitoring, and license enforcement are unrelated platform functions.

Question 14LogRhythm SIEM Platform Administration

An administrator wants to reduce alarm noise by preventing duplicate alarms for the same condition within a short window. Which LogRhythm concept is most relevant?

  1. Entity time zone configuration
  2. Alarm suppression or de-duplication settings Correct answer.
  3. Data Indexer retention
  4. Log source parsing overrides

Explanation

Alarm suppression and de-duplication settings prevent repeated notifications for the same underlying condition within a defined period, reducing noise. Retention, parsing, and time zone settings do not control alarm repetition.

Question 15LogRhythm SIEM Platform Administration

Which statement best describes the relationship between a LogRhythm Log Source and a Log Source Type?

  1. A Log Source is an individual configured collection endpoint, while a Log Source Type defines parsing and normalization for a class of devices Correct answer.
  2. A Log Source Type is a storage volume, while a Log Source is a retention policy
  3. A Log Source Type is an individual endpoint, while a Log Source defines parsing for a class of devices
  4. A Log Source and a Log Source Type are identical objects with different display names

Explanation

A Log Source represents a specific configured device or feed sending data, whereas the Log Source Type is the reusable definition of how that class of device's logs are parsed and normalized. Many Log Sources can share one Log Source Type.

Question 16LogRhythm SIEM Platform Administration

What is the role of the LogRhythm Platform Manager in a distributed deployment?

  1. It collects raw logs from network devices
  2. It performs correlation and raises alarms
  3. It stores and indexes all event data for search
  4. It provides centralized management, configuration, and licensing services for the platform Correct answer.

Explanation

The Platform Manager is the management tier that centralizes configuration, licensing, and coordination services across the deployment. Storage, collection, and correlation are handled by the Indexer, Agents, and AI Engine respectively.

Question 17LogRhythm SIEM Platform Administration

An administrator needs to review which log sources have stopped sending events. Which LogRhythm capability most directly supports this operational check?

  1. The correlation rule editor
  2. The Platform Manager license page
  3. Log source health and status monitoring in the Web Console Correct answer.
  4. The Data Indexer retention configuration

Explanation

Log source health/status views report whether configured sources are actively sending data, enabling administrators to spot silent sources. Correlation editing, retention, and licensing pages do not report collection health.

Question 18LogRhythm SIEM Platform Administration

Which LogRhythm capability enables risk-based prioritization by accumulating risk scores on entities over time?

  1. Agent heartbeat intervals
  2. Data Indexer compression settings
  3. Platform Manager backup schedules
  4. Risk-based analytics in the AI Engine Correct answer.

Explanation

Risk-based analytics in the AI Engine accumulate risk scores associated with entities and events, allowing analysts to prioritize the highest-risk activity. Compression, heartbeat intervals, and backup schedules do not affect risk scoring.

Question 19LogRhythm SIEM Platform Administration

A security team wants to ensure that only certain analysts can view events for a specific business unit's log sources. Which LogRhythm mechanism enforces this?

  1. Data Indexer sharding
  2. Alarm rule thresholds
  3. Log source parsing overrides
  4. Entity-based access control and user role permissions Correct answer.

Explanation

LogRhythm scopes visibility and permissions through Entities combined with user role assignments, so analysts only see data for the entities they are authorized for. Sharding, parsing, and alarm thresholds do not enforce data visibility.

Question 20LogRhythm SIEM Platform Administration

What is the primary function of a LogRhythm Mediator?

  1. To parse raw log messages into normalized fields
  2. To store indexed events for search
  3. To provide the graphical investigation interface
  4. To coordinate High Availability failover and manage clustered node communication Correct answer.

Explanation

Mediators are used in High Availability configurations to manage cluster membership and coordinate failover between nodes. Parsing, storage, and the user interface are handled by other components.

Question 21LogRhythm SIEM Platform Administration

An administrator is troubleshooting why events from a source appear with incorrect timestamps. Which configuration is most likely responsible?

  1. The alarm rule severity mapping
  2. The time zone and timestamp parsing settings associated with the log source Correct answer.
  3. The Platform Manager license tier
  4. The Data Indexer retention period

Explanation

Incorrect timestamps usually stem from mismatched time zone configuration or timestamp parsing definitions for the log source, which cause LogRhythm to misinterpret the event time. Retention, severity mapping, and licensing do not alter timestamp interpretation.

Question 22LogRhythm SIEM Platform Administration

Which LogRhythm object would an administrator configure to define what action occurs when a correlation rule fires, such as sending an email notification?

  1. An entity time zone setting
  2. A log source parsing override
  3. An alarm rule with configured notification actions Correct answer.
  4. A Data Indexer retention policy

Explanation

Alarm rules define the response behavior when correlation conditions are met, including notification actions such as email. Parsing overrides, retention policies, and time zone settings do not define alarm response actions.

Question 23LogRhythm SIEM Platform Administration

An organization wants to ingest logs from a cloud service that cannot run a LogRhythm Agent. Which collection approach is most appropriate?

  1. Deploy a Mediator to the cloud service
  2. Configure the Platform Manager to poll the service directly
  3. Use an agentless collection method such as syslog or an API-based integration feeding a Data Processor Correct answer.
  4. Install a Data Indexer on the cloud host

Explanation

When an Agent cannot be installed, LogRhythm supports agentless collection methods such as syslog forwarding or API-based integrations that deliver events to a Data Processor. Indexers, Mediators, and the Platform Manager are not collection endpoints for external sources.

Question 24LogRhythm SIEM Platform Administration

What does the LogRhythm common event schema enable across different log sources?

  1. Automatic remediation of detected threats
  2. Automatic encryption of all stored events
  3. Guaranteed real-time delivery of every event
  4. Consistent field names and values that allow unified search, reporting, and correlation Correct answer.

Explanation

The common event schema standardizes field names and value formats so that events from diverse sources can be searched, reported, and correlated uniformly. It does not provide encryption, delivery guarantees, or automated remediation.

Question 25LogRhythm SIEM Platform Administration

Which LogRhythm component is typically deployed closest to the log sources in a distributed environment to reduce WAN traffic?

  1. System Monitor Agent Correct answer.
  2. AI Engine
  3. Platform Manager
  4. Data Indexer

Explanation

Deploying System Monitor Agents near the sources allows local collection and processing before forwarding, reducing WAN bandwidth consumption. Indexers, the AI Engine, and the Platform Manager are centralized roles not placed for local collection.

Question 26LogRhythm SIEM Platform Administration

Which LogRhythm license entitlement determines the maximum sustained rate at which events can be written into the platform per second?

  1. Log source count limit
  2. Concurrent analyst session limit
  3. Retention day limit
  4. Events per second (EPS) rate limit Correct answer.

Explanation

LogRhythm licensing is primarily governed by an events-per-second throughput entitlement that caps sustained ingestion into the platform. Log source counts, retention duration, and user sessions are governed by separate configuration or licensing terms rather than the ingest rate metric.

Question 27LogRhythm SIEM Platform Administration

An administrator must verify that a newly deployed LogRhythm Agent is actively forwarding its collected logs to the correct Entity. Which two items must match for the Agent to associate correctly?

  1. The Agent's hostname and the Data Indexer's hostname
  2. The Entity name configured on the Agent and the Entity defined in the Client Console Correct answer.
  3. The System Monitor Agent's log file path and the Mediator's cache directory
  4. The Agent's operating system version and the Platform Manager's build number

Explanation

A System Monitor Agent is bound to an Entity by name, and that name must correspond to an Entity that exists in the deployment configuration. Mismatched Entity naming causes the Agent to register incorrectly or fail to associate, so events may not route as expected.

Question 28LogRhythm SIEM Platform Administration

Which LogRhythm Console is used to configure system-wide settings such as Users, Entities, and Global Parameters?

  1. Alarm Console
  2. Client Console Correct answer.
  3. Web Console
  4. Admin Console

Explanation

The Client Console is used for system-wide administration, including Users, Entities, and Global Parameters. Its Administrator Guide covers user access, entity management, Deployment Manager, and advanced system settings, so the administrative functions in the question belong to this console.

Question 29LogRhythm SIEM Platform Administration

What is the purpose of a LogRhythm Global Parameter?

  1. To assign a fixed IP address to each Mediator
  2. To store a reusable value that multiple rules and objects can reference centrally Correct answer.
  3. To define the physical storage path for indexed event data
  4. To encrypt Agent-to-Mediator communications

Explanation

Global Parameters hold named values that rules and other objects reference, so a change propagates to every consumer without editing each object. This centralizes tuning of thresholds, lists, and other shared values.

Question 30LogRhythm SIEM Platform Administration

Which LogRhythm feature allows an administrator to schedule automated reports that are emailed to stakeholders on a recurring basis?

  1. Alarm Rules
  2. Log Source Virtualization
  3. Report Packages and scheduled report jobs Correct answer.
  4. Knowledge Base overrides

Explanation

Report Packages bundle report definitions, and scheduled jobs deliver them automatically on a defined cadence to configured recipients. This is the standard mechanism for recurring stakeholder reporting.

Question 31LogRhythm SIEM Platform Administration

Which LogRhythm object defines the retention period applied to a specific type of log data before it is purged?

  1. Notification Template
  2. Alarm Rule
  3. Retention Policy Correct answer.
  4. Entity Profile

Explanation

Retention Policies specify how long data is kept and are applied to log sources or data classes. They determine when older data is aged out of the platform.

Question 32LogRhythm SIEM Platform Administration

An administrator wants to confirm which LogRhythm software version and build are running across the deployment. Where is this information most directly reviewed?

  1. The Log Source Type list
  2. The About or deployment status view in the Admin Console Correct answer.
  3. The Knowledge Base module list
  4. The Alarm Console's active alarm list

Explanation

Version and build information for deployed components is surfaced through administrative status and About views in the Admin Console. This lets an administrator confirm patch level across the deployment.

Question 33LogRhythm SIEM Platform Administration

What is the primary purpose of a LogRhythm Knowledge Base module?

  1. To package parsing, classification, and enrichment definitions that can be deployed to processing components Correct answer.
  2. To define user role permissions
  3. To store analyst case notes for investigations
  4. To schedule automated backups of the Platform Manager

Explanation

Knowledge Base modules contain the processing logic, including parsing and classification definitions, that processing components use to interpret events. They are versioned and deployed to keep processing content current.

Question 34LogRhythm SIEM Platform Administration

An administrator needs to tune which events a specific log source sends to the platform so that noisy, low-value events are dropped before processing. Which configuration should be adjusted?

  1. The Entity's time zone setting
  2. The analyst's personal dashboard layout
  3. Log source filters on the source's collection configuration Correct answer.
  4. The Data Indexer's storage allocation

Explanation

Log source filters allow administrators to exclude or include events at collection, reducing unnecessary processing and storage for low-value data. Filtering at the source is the most efficient way to suppress noise before it reaches processing components.

Question 35LogRhythm SIEM Platform Administration

An administrator must ensure that events from a high-value source are processed even when the primary Mediator is offline. Which configuration supports this?

  1. Configure the log source with a secondary Mediator and enable failover Correct answer.
  2. Increase the retention period on the log source
  3. Assign the source to a different Entity
  4. Disable normalization for that source

Explanation

Configuring a secondary Mediator with failover allows collection and processing to continue if the primary Mediator becomes unavailable. This provides resilience for critical sources without manual intervention.

Question 36LogRhythm SIEM Platform Administration

An analyst reports that alarms from a specific rule are firing but no notifications are being delivered. Which configuration is the most likely cause?

  1. The analyst's user account lacks search permissions
  2. The log source's parsing is incomplete
  3. The Data Indexer has insufficient disk space
  4. The alarm rule's notification settings or the associated notification template are misconfigured Correct answer.

Explanation

Alarm delivery depends on notification configuration associated with the alarm rule, including templates and recipients. If alarms fire but no messages arrive, the notification path is the first place to inspect.

Question 37LogRhythm SIEM Platform Administration

An administrator wants to give a contractor read-only visibility into alarms for a single Entity while preventing access to other Entities. Which mechanism accomplishes this?

  1. Entity-based access control assigned through the user's role and Entity permissions Correct answer.
  2. A separate Admin Console installation for the contractor
  3. Disabling alarms for all other Entities
  4. Sharing the administrator's credentials with the contractor

Explanation

LogRhythm scopes user access by Entity, so assigning a role with read-only rights limited to the relevant Entity restricts visibility appropriately. This enforces least privilege without affecting other users.

Question 38LogRhythm SIEM Platform Administration

An administrator is preparing to add a new log source and wants the platform to automatically recognize and parse its events. What should be verified first?

  1. That a matching Log Source Type with a supported MPE processing rule exists Correct answer.
  2. That the source is assigned to the Platform Manager
  3. That the analyst has report scheduling rights
  4. That the source's retention period is set to the maximum

Explanation

Successful automatic parsing depends on a Log Source Type whose processing rules match the event format. Confirming support before onboarding avoids unparsed or misclassified data.

Question 39LogRhythm SIEM Platform Administration

Which LogRhythm capability allows an administrator to define a sequence of conditions that must occur in order before an alarm is raised?

  1. Log source filters
  2. Normalization profiles
  3. Single-event threshold rules
  4. Multi-event correlation rules Correct answer.

Explanation

Multi-event correlation rules evaluate ordered sequences of events across time, enabling detection of multi-step behaviors. Single-event rules evaluate one event at a time and cannot express ordered sequences.

Question 40LogRhythm SIEM Platform Administration

An administrator wants to reduce storage consumption for verbose debug logs while preserving security-relevant events. Which approach is most appropriate?

  1. Disable indexing for the entire deployment
  2. Route all events to a secondary Mediator
  3. Shorten the retention period for all log data
  4. Apply log source filters to exclude the debug events and keep security events Correct answer.

Explanation

Filtering at the log source removes low-value debug events before they consume processing and storage, while security-relevant events continue to flow. Blanket retention or indexing changes would affect all data and could break investigations.

Question 41LogRhythm SIEM Platform Administration

Which LogRhythm setting ensures that events arriving from a source in a different region are interpreted with the correct local time?

  1. The Entity's alarm suppression window
  2. The log source's time zone configuration Correct answer.
  3. The Mediator's cache size
  4. The Knowledge Base module version

Explanation

Time zone configuration on the log source determines how timestamps are interpreted and normalized. Correct configuration prevents skewed event times and unreliable correlation windows.

Question 42LogRhythm SIEM Platform Administration

An administrator must confirm that a Mediator is receiving and processing events from its assigned sources. Which indicator is most direct?

  1. The count of installed Knowledge Base modules
  2. The number of configured users in the deployment
  3. Event counts and last-seen timestamps for the associated log sources Correct answer.
  4. The size of the report package library

Explanation

Event counts and last-seen timestamps directly show whether a source is actively delivering events through its Mediator. These indicators distinguish collection failures from downstream processing issues.

Question 43LogRhythm SIEM Platform Administration

Which LogRhythm object is used to define the criteria that determine which events are retained for forensic deep-dive versus routine retention?

  1. Entity time zone settings
  2. Data retention policies applied per log source or data type Correct answer.
  3. Alarm notification templates
  4. User role definitions

Explanation

Retention policies can be scoped to specific log sources or data types, allowing high-value data to be kept longer than routine data. This balances investigative needs against storage cost.

Question 44LogRhythm SIEM Platform Administration

An administrator is asked to grant a new analyst the ability to run searches but not to modify alarm rules. Which configuration approach satisfies this?

  1. Assign a role with search permissions but without rule-editing privileges Correct answer.
  2. Disable alarm rules globally
  3. Provide the analyst with the Admin Console credentials
  4. Assign the administrator role to the analyst

Explanation

Role-based permissions allow granting only the capabilities required, such as search, while withholding configuration rights like rule editing. This follows least-privilege principles.

Question 45LogRhythm SIEM Platform Administration

A correlation rule uses a Global Parameter for its threshold. An administrator changes the parameter value. What is the expected effect?

  1. The change applies only after a full platform restart
  2. Only newly created rules inherit the change
  3. The rule uses the new value without editing the rule itself Correct answer.
  4. The rule stops functioning until it is republished

Explanation

Global Parameters are referenced by rules at evaluation time, so updating the parameter value updates behavior for every rule that references it. No per-rule edit is required.

Question 46LogRhythm SIEM Platform Administration

An administrator observes that a log source is sending events but they appear unparsed with missing field values. Which cause is most likely?

  1. The assigned Log Source Type does not match the actual event format Correct answer.
  2. The retention period is too short
  3. The analyst lacks report permissions
  4. The Entity time zone is set incorrectly

Explanation

Unparsed events with missing fields typically indicate a mismatch between the assigned Log Source Type and the actual event format. Correcting the type or processing rule restores field extraction.

Question 47LogRhythm SIEM Platform Administration

An administrator needs to confirm that a configuration change made in the Admin Console has propagated to all processing components. Which action is most appropriate?

  1. Restart every analyst workstation
  2. Verify component synchronization status and confirm the change is reflected on each component Correct answer.
  3. Disable the Knowledge Base
  4. Delete and recreate all log sources

Explanation

Configuration changes propagate to processing components through synchronization, so verifying sync status confirms the change reached each component. This avoids assuming propagation succeeded when a component is out of sync.

Question 48LogRhythm SIEM Platform Administration

A deployment experiences a sudden drop in processing throughput. Which combination of factors should an administrator examine first?

  1. The list of installed Knowledge Base module names
  2. The number of report packages and user dashboards
  3. Mediator resource utilization, EPS license headroom, and Data Indexer health Correct answer.
  4. The count of Entity profiles and notification templates

Explanation

Throughput depends on processing capacity, license headroom, and indexing health, so these are the primary suspects for a sudden drop. Examining them together distinguishes capacity exhaustion from a component failure.

Question 49LogRhythm SIEM Platform Administration

An administrator wants to ensure that a custom parsing change survives a future Knowledge Base update. Which practice is most appropriate?

  1. Implement the change as a supported customization that is preserved through updates Correct answer.
  2. Disable Knowledge Base updates permanently
  3. Edit the shipped module files directly on each component
  4. Copy the module files to analyst workstations as a backup

Explanation

Supported customization mechanisms are designed to persist across Knowledge Base updates, whereas direct edits to shipped content can be overwritten. Using the supported path protects the customization during upgrades.

Question 50LogRhythm SIEM Platform Administration

An administrator must design Entity scoping so that a managed service provider's analysts see only their assigned customers' data while a central team sees all customers. Which design is most appropriate?

  1. Disable Entity-based access control for simplicity
  2. Create one user account shared by all analysts
  3. Place all customers in one Entity and rely on search filters
  4. Create an Entity per customer and assign analyst roles scoped to those Entities, with a broader role for the central team Correct answer.

Explanation

Separate Entities per customer combined with Entity-scoped roles enforce data separation, while a broader role grants the central team cross-Entity visibility. This satisfies both isolation and oversight requirements.