[&] In the context of log aggregation, what is meant by 'correlation'?
- Combining logs to save storage space
- Associating related events across systems for analysis
- Sorting logs in chronological order
- Encrypting logs before storage

[&] What defines the difference between push-based and pull-based log collection models?
- Pull-based is faster than push-based
- Push-based involves the source, while pull-based uses a central system
- Push-based requires less configuration than pull-based
- Pull-based always uses HTTP protocols

[&] What is the primary goal of log collection in a centralized logging pipeline?
- To localize logs for each system individually
- To reduce the size of logs before storage
- To encrypt logs for secure transit
- To centralize visibility and prepare logs for analysis

[&] What benefit does buffering provide in the context of log shipping?
- Reduces the need for a centralized SIEM
- Prevents data loss when network interruptions occur
- Increases the speed of data transmission across networks
- Automatically encrypts logs during transport

[&] Which of the following is an advantage of agent-based log collection?
- It necessitates less maintenance than agentless collection
- It allows customization and enrichment of logs before shipping
- It is less costly compared to agentless collection
- No installation is required on endpoints

[&] Why is it important to use TLS encryption during log shipping?
- To secure logs in transit from unauthorized access
- To increase the speed of log analysis
- To ensure logs are collected in a timely manner
- To minimize network bandwidth usage