Network Logs Monitoring and Analysis CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst needs to visualize log data to spot trends over time, such as a gradual increase in failed logins. Which tool is best suited for this?

   • AUse the ELK stack (Elasticsearch, Logstash, Kibana) to index logs and create time-series visualizations.
   • BUse grep to count occurrences of 'failed login' in the logs.
   • CUse a text editor to manually review logs.
   • DUse a packet analyzer to capture new logs.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A user cannot access a shared folder on a file server. The analyst checks the file server's security log and finds 'access denied' events for the user's account. What should the analyst do next?

   • ADisable the user's account and re-enable it.
   • BReboot the file server to clear the error.
   • CCheck the user's group memberships and the folder's permissions.
   • DCheck the network switch logs for connectivity issues.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which tool is specifically designed to provide real-time collection, indexing, and search of log data from multiple sources?

   • ANmap
   • Btcpdump
   • CSIEM (Security Information and Event Management)
   • DWireshark
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has a distributed network with multiple branch offices. They want to centralize logs from all branches for analysis, but the WAN links have limited bandwidth. What is the best approach to minimize bandwidth usage while still collecting logs?

   • AUse a VPN tunnel to send logs securely, but do not compress them.
   • BDeploy a local log collector at each branch that pre-processes and compresses logs before sending them to the central SIEM.
   • CStore logs locally at each branch and only send them on demand.
   • DSend all logs directly from each device to the central SIEM.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of correlating events across multiple log sources?

   • ACounting the number of logs generated per hour
   • BReviewing a single application log for error messages
   • CDeleting duplicate log entries
   • DMatching a firewall block event with a subsequent failed login attempt on a server
   Reveal Solution Discussion Select an answer first