Network Logs Monitoring and Analysis CCT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is loading logs from a firewall (text-based), a Windows server (Event Log), and a Linux application (JSON) into a SIEM. The SIEM requires all logs to have a common timestamp format and field names. What is the first step the analyst should perform?

   • AManually review each log entry and convert it to the SIEM format using a text editor.
   • BDefine a parsing and normalization rule for each source to map fields to a common schema.
   • CDisable logging on sources that do not natively support the SIEM format.
   • DIncrease the log retention period for all sources to ensure enough data is available.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which log format is commonly used by network devices such as routers and switches to send event messages to a central logging server?

   • APCAP
   • BJSON
   • CWindows Event Log format
   • DSyslog
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   During an investigation, an analyst finds: (1) a firewall log showing an outbound connection to a known malicious IP, (2) a DNS log showing a query for a suspicious domain, and (3) an endpoint log showing a process executing a script. Each event occurred within two minutes. What does this correlation most likely indicate?

   • AA false positive caused by a user browsing a legitimate website.
   • BA multi-stage attack chain where the endpoint resolved the domain, connected outbound, and executed a script.
   • CA network misconfiguration that caused the endpoint to contact the IP accidentally.
   • DAn insider threat where an employee intentionally visited the malicious site.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A healthcare organization must retain patient access logs for six years per regulation. They currently store logs on a local server with no redundancy. What should they implement to meet compliance while protecting log integrity?

   • ADelete logs older than one year to reduce storage costs.
   • BStore logs in a write-once-read-many (WORM) storage system with replication to a second site.
   • CEmail logs to a personal archive to save costs.
   • DCompress logs and store them on the same server to save space.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A network administrator is troubleshooting intermittent connectivity issues. The firewall logs show dropped packets, the switch logs show CRC errors, and the server logs show TCP retransmissions. What is the most likely root cause?

   • AAn overloaded server causing application timeouts.
   • BA DNS resolution failure.
   • CA faulty network cable or interface causing physical-layer errors.
   • DA misconfigured firewall rule blocking traffic.
   Reveal Solution Discussion Select an answer first