An organization's security policy requires that all successful and failed logon attempts be recorded for 1 year. The Windows servers currently have the Security log set to overwrite events as needed, and the log size is 128 MB. You need to ensure compliance without losing events. What should you do?

Increase the Security log size to a sufficient amount and set retention to 'Archive the log when full, do not overwrite events'

Set the Security log to 'Do not overwrite events' without increasing the size

Enable 'Audit logon events' for success only

Manually export the Security log to a file every week

A Windows server experienced a blue screen (BSOD) and rebooted. After the server comes back up, you need to identify which driver caused the crash. Where should you look first?

Security log for logon events around the time of the crash

System log in Event Viewer for a critical error event with a bugcheck code

Application log for the application that was running at the time

Setup log for recent driver installations

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 3Objective 5

Interpret System Logs 100-160 Practice Questions (Page 1)

Part of the Endpoint Security Concepts domain, which makes up ~25% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~5–9 in this domain), expect 1–2 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

6concepts

Questions 1–5

1expert · hard
An organization's security policy requires that all successful and failed logon attempts be recorded for 1 year. The Windows servers currently have the Security log set to overwrite events as needed, and the log size is 128 MB. You need to ensure compliance without losing events. What should you do?
Select an answer first
2application · medium
A Windows server experienced a blue screen (BSOD) and rebooted. After the server comes back up, you need to identify which driver caused the crash. Where should you look first?
Select an answer first
3foundation · easy
A software application writes an error to the Windows event log when it fails to save a file. In which log would this event be recorded?
Select an answer first
4application · easy
A Windows administrator needs to review all successful and failed logon attempts on a domain controller. Which Event Viewer log should the administrator use?
Select an answer first
5expert · hard
A network administrator is configuring syslog on a router to send logs to a central server. The administrator wants to ensure that the most critical messages are sent even if the network is congested. Which syslog severity level should be configured as the minimum to send?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Interpret System Logs 100-160 Practice Questions (Page 1)

Questions 1–5

A Windows server experienced a blue screen (BSOD) and rebooted. After the server comes back up, you need to identify which driver caused the crash. Where should you look first?

A software application writes an error to the Windows event log when it fails to save a file. In which log would this event be recorded?

A Windows administrator needs to review all successful and failed logon attempts on a domain controller. Which Event Viewer log should the administrator use?

A network administrator is configuring syslog on a router to send logs to a central server. The administrator wants to ensure that the most critical messages are sent even if the network is congested. Which syslog severity level should be configured as the minimum to send?

Keep studying — Endpoint Security Concepts