Which scenario best illustrates event correlation across multiple logs?

A firewall log shows a port scan, and an IDS log shows a subsequent exploit attempt against the same IP

A system log shows a successful reboot

An authentication log shows a single failed login

A web-server log shows a single 404 error

A company has servers in multiple cloud regions and on-premises. They want to centralize logs for security monitoring. Which solution would best aggregate logs from all sources?

Enable verbose logging on all servers

Use a spreadsheet to manually compile logs

Deploy a SIEM platform and configure log forwarders on all systems

Store logs locally on each server

An analyst is investigating a potential privilege escalation on a Linux server. Which log file would provide the most relevant information about user privilege changes?

System log (e.g., /var/log/syslog)

Sudo log (e.g., /var/log/sudo.log or auth.log with sudo entries)

Authentication log (e.g., /var/log/auth.log)

Kernel log (e.g., /var/log/kern.log)

An analyst is correlating events and finds that a user logged in from a new IP, then immediately changed their password, and then accessed a sensitive database. Which conclusion is most likely?

The account may be compromised, and the attacker is establishing persistence

The database access is unrelated to the login

The user is testing a new device

The user is following a normal password change procedure

CertNexusCyberSec First Responder (CFR)

Domain 2Objective 1

Objective 2.1 Analyze Logs for Signs of Attack. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 6)

Part of the 2.0 Analyze Attacks on Computing Environments domain, which accounts for 20% of the CYBERSEC-FIRST-RESPONDER exam.

38questions here

8free pages

10concepts

20%of the exam

Questions 26–30

26foundation · easy
Which scenario best illustrates event correlation across multiple logs?
Select an answer first
27application · medium
A company has servers in multiple cloud regions and on-premises. They want to centralize logs for security monitoring. Which solution would best aggregate logs from all sources?
Select an answer first
28application · medium
An analyst is investigating a potential privilege escalation on a Linux server. Which log file would provide the most relevant information about user privilege changes?
Select an answer first
29expert · hard
An analyst is correlating events and finds that a user logged in from a new IP, then immediately changed their password, and then accessed a sensitive database. Which conclusion is most likely?
Select an answer first
30foundation · easy
Which log-analysis platform is built on the Elasticsearch, Logstash, and Kibana components and is commonly used for centralized log storage and visualization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.