Objective 2.1 Analyze Logs for Signs of Attack. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is event correlation in the context of log analysis?

   • ASorting log entries by timestamp
   • BDeleting duplicate log entries
   • CEncrypting log data for secure storage
   • DCombining events from multiple logs to identify patterns or sequences indicative of an attack
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst notices a series of failed login attempts to a web application, followed by a successful login from the same IP address, and then a rapid download of a large file. Which log sources should the analyst correlate to confirm the sequence of events?

   • AWeb server error logs and application logs
   • BFirewall logs and DNS logs
   • CKernel logs and system logs
   • DAuthentication logs and web server access logs
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which type of log file records events such as user logon attempts, account lockouts, and changes to user permissions?

   • AAuthentication log
   • BSystem log
   • CKernel log
   • DWeb-server log
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is reviewing web server logs and notices a pattern of requests to '/admin' with varying query parameters, each returning a 404 status. What does this pattern most likely indicate?

   • AA distributed denial-of-service attack
   • BA successful SQL injection attack
   • CA directory brute-force or enumeration attempt
   • DNormal user browsing behavior
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC team frequently runs the same query to find failed logins from external IPs. They want to streamline this recurring analysis. Which approach would be most effective?

   • AIncrease the log retention period
   • BDisable logging for external IPs
   • CManually type the query each time
   • DCreate a saved search for the query
   Reveal Solution Discussion Select an answer first