Network Logs Monitoring and Analysis CCT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of configuring alerts in a log monitoring system?

   • ATo automatically fix security issues
   • BTo notify security personnel of potential incidents in a timely manner
   • CTo replace the need for manual log review
   • DTo reduce log storage requirements
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A user reports that they cannot access a file share. The authentication logs show a successful login, but the file server logs show an access denied error. The firewall logs show no blocked traffic. What is the most likely cause and what log should be examined next?

   • AThe user's password may have expired; examine the authentication logs for password expiration events.
   • BThe network path may be down; examine the router logs for connectivity issues.
   • CThe file server may be offline; examine the server's system logs for shutdown events.
   • DThe user's account may not have permission to the share; examine the file server's security logs for the specific permission failure.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which factor is most important when determining how long to retain security logs?

   • AThe color of the log files
   • BThe number of log sources
   • CCompliance requirements and organizational policy
   • DThe size of the log files
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which technique is used to extract structured data from unstructured or semi-structured log messages?

   • ALog compression
   • BLog rotation
   • CLog parsing
   • DLog signing
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team needs to provide a weekly summary of security events to management. The summary should highlight trends and notable incidents. What is the most efficient way to generate this report?

   • AManually compile the report by reviewing all logs each week.
   • BUse a spreadsheet to copy and paste log entries.
   • CAsk each system administrator to send their own report.
   • DCreate a scheduled SIEM report that aggregates key metrics and automatically emails it to stakeholders.
   Reveal Solution Discussion Select an answer first