Network Logs Monitoring and Analysis CCT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of a centralized log aggregation system?

   • ATo encrypt logs in transit
   • BTo generate real-time alerts for every log entry
   • CTo collect logs from multiple sources into a single repository for analysis
   • DTo replace the need for individual device log storage
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst notices a sudden spike in failed authentication attempts in the Windows Event Log, followed by a successful login from a foreign IP at 3 AM. Which manual analysis technique would best confirm whether this is a brute-force attack?

   • AReview the firewall log for blocked inbound connections.
   • BSearch for all events from that IP address across the time window and correlate with other logs.
   • CLook for any error messages in the system log.
   • DCheck the total number of log entries in the last hour.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An analyst wants to identify all login failures across multiple servers and then determine if any were followed by a successful login from the same IP. Which analysis technique is most effective?

   • ASearch for successful logins only.
   • BCorrelate authentication events across servers by IP address and time.
   • CUse a packet capture tool to analyze login traffic.
   • DCount the total number of login failures per server.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst notices a spike in failed login attempts on the VPN gateway, followed by a successful login from the same IP address, and then a large data download from a file server. Which log analysis technique would best identify this as a potential attack chain?

   • ACorrelate events across the VPN, authentication, and file server logs to see the sequence of actions.
   • BSearch each log source independently for anomalies.
   • CReview the VPN gateway logs for the source IP address.
   • DCheck the file server logs for unusual file access patterns.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is evaluating log monitoring tools. They need to handle a high volume of logs, support complex queries, and provide real-time alerting. They also have a limited budget and prefer open-source solutions. Which tool would best meet these requirements?

   • AA custom-built solution using grep and shell scripts.
   • BA commercial SIEM with advanced correlation and compliance reporting.
   • CELK stack (Elasticsearch, Logstash, Kibana) with a SIEM app.
   • DA simple log viewer that supports basic search.
   Reveal Solution Discussion Select an answer first