CSA (312-39) SOC Simulation Lab

In this module, you will design a SIEM ingestion architecture and distinguish between the fundamental log transport mechanisms used in real-world SOC operations.

Scenario Context

You are a Tier 3 analyst and SIEM engineer tasked with onboarding a new segment of DMZ Linux web servers and internal Windows Domain Controllers into your Splunk environment. The network security team requires a detailed data flow diagram detailing how logs move from endpoints to the indexers.

You are configuring agents on the endpoint operating systems to actively forward their logs as soon as they are generated to ensure near real-time detection capabilities.

Security Environment

Below are configuration snippets from two different log sources in your environment. Notice which system initiates the connection.

# Snippet 1: DMZ Web Server (/etc/rsyslog.conf) # The application actively forwards messages to the SIEM receiver. *.* @@10.50.2.100:514 # Snippet 2: SIEM API Polling Script (Python) # The SIEM reaches out to AWS CloudTrail via API to fetch logs every 5 mins. response = client.lookup_events( LookupAttributes=[{'AttributeKey': 'EventId', 'AttributeValue': last_id}], MaxResults=50 )

In which log collection mechanism, the system or application sends log records either on the local disk or over the network. A. rule-based B. pull-based C. push-based D. signature-based

Analyst Hint: Pay attention to the verb "sends". If the endpoint application is generating the log and immediately transmitting it to a central server (like Syslog or a Splunk Forwarder), it is actively delivering the data. What is the network term for this? (Note: Do not confuse detection logic with network transport).

Expert Insight

1. What is Happening (SOC Level)

When engineering a SIEM, you must decide how data gets from point A (the server) to point B (the SIEM). We generally choose between installing a lightweight agent on the server that actively forwards data, or having the SIEM reach across the network to scrape logs off the server via protocols like WMI or REST APIs.

2. Why the Correct Answer is Correct (C: push-based)

The correct architectural term for an application or system sending log records directly to a centralized location is push-based collection.

(Note: While some test dumps inaccurately label "A" as the answer for this specific phrasing, "rule-based" refers to access controls or detection logic, NOT log transport. In a realistic engineering environment, endpoints actively sending data is definitively push-based, like Rsyslog, Fluentd, or Splunk Universal Forwarders.)

3. Why the Other Options are Wrong

Pull-based (B) means the SIEM or log collector reaches out to the source to request/fetch the logs (e.g., polling an AWS API, or WMI polling). Rule-based (A) and Signature-based (D) are completely unrelated to network transport; they are methodologies used by Firewalls, IDS/IPS, and SIEM correlation engines to detect threats.

🛡️ SOC MINI LESSON: Push vs Pull Architecture

Understanding when to use Push vs Pull is critical for bypassing firewalls and ensuring high-fidelity data.

Push Architecture (Agents/Syslog): Preferred for SOCs. Lower latency. Requires outbound firewall rules from the endpoint to the SIEM (e.g., TCP 514, TCP 9997). The endpoint CPU handles the packaging.
Pull Architecture (API/WMI): Good for cloud services (AWS CloudTrail, O365 Management API) or systems where installing an agent is strictly prohibited. Introduces polling latency (e.g., 5-minute delays). Requires the SIEM to have credentials to access the endpoint.

Ready to sharpen your defensive thinking further?

Explore more CSA simulations and practice exams →