In which log collection mechanism, the system or application sends log records either on the local disk or over the network.

Question breakdown

Tests

Distinguish log collection mechanisms

Difficulty

Easy

Key idea: In push-based collection, the source system or application actively sends its log records, either to local disk or over the network to a collector.

How to reach the answer

1. Clue: 'the system or application sends log records,' meaning the source initiates the transfer.
2. Pull-based collection has the collector request or retrieve logs from the source.
3. Rule-based and signature-based are detection or correlation methods, not collection mechanisms.
4. Source-initiated sending, as with syslog forwarding, is push-based.

Each option

• AIncorrect. Rule-based describes correlation or detection logic, not how logs are transported.
• BIncorrect. In pull-based collection, the collector retrieves logs from the source rather than the source sending them.
• CCorrect. Push-based means the source sends log records itself to local storage or across the network.
• DIncorrect. Signature-based is a detection technique used by IDS/AV, not a log collection mechanism.

Common trap: Candidates may mix up push and pull, forgetting that the deciding factor is which side initiates the transfer.

In practice: Syslog forwarding from network devices to a SIEM is push-based, while polling Windows hosts via WMI or an API is pull-based.

Remember: If the source sends the logs, it is push; if the collector fetches them, it is pull.

Drafted with AI assistance and checked against the answer key.