Which two things should you take into consideration before scaling collectors at a customer site? (Choose two.)

Question

Options

• ADirect log collection
• BPerformance monitoring and SIEM collection jobs
• CThe types of operating systems running in the network
• DThe complexity of the network

• A
  95% (20)
• D
  5% (1)

Explanation

Before scaling collectors, you must evaluate direct log collection (A) because it determines the volume and method of raw data being ingested - if existing collection pipelines are already strained, scaling without addressing this creates bottlenecks. Performance monitoring and SIEM collection jobs (B) must also be assessed because the active workload on your collectors (scheduled jobs, parsing tasks, event processing) directly dictates whether additional collectors are needed and how resources should be distributed.

Options C and D are distractors: OS types (C) influence agent configuration but are not a primary scaling trigger, and network complexity (D) is too broad a concept - complexity alone doesn't tell you how to scale collectors or when capacity is being exceeded.

Memory tip: Think "What's already running?" - Direct log collection (A) tells you what data is flowing in, and SIEM collection jobs (B) tell you how hard the system is working. Both are operational, measurable factors, unlike the vaguer infrastructure descriptors in C and D.

No community discussion yet for this question.