Interpret System Logs 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A network engineer is configuring syslog on a router to send logs to a central server. The engineer notices that the router's clock is set to UTC, but the central server is in a different time zone. The engineer wants to ensure that log timestamps are consistent for analysis. Which configuration should be applied?

   • ADisable logging timestamps on the router
   • BSet the router's clock to the central server's time zone
   • CConfigure the router to use NTP and set the logging timestamp to UTC
   • DConfigure the central server to convert timestamps to the router's time zone
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your organization runs a mix of Linux servers, Cisco network switches, and a Windows-based SIEM. You need to centralize log collection from all devices into the SIEM for anomaly detection. What is the most efficient standard method to accomplish this?

   • AManually export logs from each device and import them into the SIEM daily.
   • BUse Windows Event Forwarding to collect logs from all devices.
   • CConfigure each device to send syslog messages to the SIEM's syslog collector.
   • DInstall a custom agent on every device that forwards logs to the SIEM.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which type of log is most likely to contain an entry about a device driver failing to load during system startup?

   • AApplication log
   • BSecurity log
   • CSystem log
   • DForwarded Events log
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of the Windows Application log?

   • ATo record events related to hardware device drivers
   • BTo record security-related events such as logon attempts
   • CTo record events generated by software applications running on the system
   • DTo record events related to the Windows kernel
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   Your organization has a centralized syslog server that receives logs from routers, switches, and Linux servers. You notice that logs from a specific router stop arriving at 2:00 AM and resume at 2:15 AM. What is the most likely cause?

   • AThe syslog server's time zone was misconfigured
   • BThe router's syslog severity level was changed to 'emergencies only'
   • CThe router was rebooted or lost network connectivity during that window
   • DThe syslog server ran out of disk space
   Reveal Solution Discussion Select an answer first