Network Logs Monitoring and Analysis CCT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which storage solution is most appropriate for long-term archival of logs that are rarely accessed but must be retained for compliance?

   • AIn-memory cache
   • BCold storage or object storage
   • CTemporary file system
   • DLocal SSD on the log source
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst is investigating a slow network performance issue. The firewall logs show normal traffic volumes, but the application logs show increased response times. The IDS logs show no alerts. What is the most likely cause and what log source should be examined next?

   • AThe network may be congested; examine the router logs for packet drops.
   • BThe DNS resolution may be slow; examine the DNS logs for query times.
   • CThe application server may be resource-constrained; examine the server's performance logs for CPU or memory usage.
   • DThere may be a security breach; examine the IDS logs more closely.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A small IT team needs to analyze logs from a few servers and wants to use a lightweight, open-source solution that allows them to search and visualize logs without a full commercial SIEM. Which tool stack would be most appropriate?

   • AUse a commercial SIEM platform with advanced correlation features.
   • BWrite custom scripts to parse logs and generate reports manually.
   • CInstall Elasticsearch, Logstash, and Kibana (ELK stack) to collect, parse, and visualize logs.
   • DUse the built-in event viewer on each server and manually review logs.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is required to retain security logs for 2 years for compliance, but they are running out of storage space. They also need to ensure that logs are tamper-proof to support legal proceedings. What is the best solution?

   • AStore logs in a cloud bucket with standard permissions.
   • BDelete logs older than 1 year to free up space.
   • CUse write-once-read-many (WORM) storage for archived logs and implement a retention policy that deletes logs after 2 years.
   • DCompress the logs and store them on the existing storage.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Users report that a web application is intermittently slow. The analyst checks the application logs and sees multiple timeout errors, but the web server logs show normal response times. Which log source should be examined next to diagnose the issue?

   • ADNS logs to check for resolution failures.
   • BFirewall logs to check for blocked traffic.
   • CIDS logs to check for intrusion attempts.
   • DDatabase logs to check for slow queries or connection pool exhaustion.
   Reveal Solution Discussion Select an answer first