Network Logs Monitoring and Analysis CCT Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An analyst is investigating a potential malware infection. Which combination of log sources would provide the most complete picture of the attack?

   • AOnly firewall logs.
   • BFirewall logs, DNS logs, and endpoint security logs.
   • COnly authentication logs.
   • DOnly application logs.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   A user reports that they cannot access a web application. Which log source would you first examine to determine if the web server received the request?

   • ADNS query log
   • BDHCP lease log
   • CWeb server access log
   • DFirewall traffic log
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A multinational company must comply with data residency regulations that require logs containing personal data to be stored within the country where the data originates. They currently use a centralized SIEM in a different country. What is the best way to handle this?

   • AStop collecting logs from countries with strict data residency laws.
   • BEncrypt the logs and store them in the central SIEM, arguing that encryption satisfies compliance.
   • CMove the central SIEM to one of the countries and store all logs there.
   • DDeploy a local log collector in each country that filters and stores personal data locally, and send only non-personal data to the central SIEM.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An analyst is investigating a data breach. The SIEM shows: (1) an authentication success for a privileged account at 2:00 AM, (2) a large data transfer from a database server to an external IP at 2:15 AM, and (3) the privileged account was disabled at 2:30 AM. What is the most likely sequence of events?

   • AThe account was compromised, used to exfiltrate data, and then disabled by the attacker to cover tracks.
   • BThe account was disabled due to a policy violation before the transfer.
   • CThe account was legitimately used by an administrator for maintenance.
   • DThe data transfer was a false positive caused by a backup job.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which type of report is most useful for demonstrating compliance with a regulatory standard that requires quarterly review of security logs?

   • AReal-time dashboard
   • BNetwork topology diagram
   • CScheduled summary report
   • DPacket capture file
   Reveal Solution Discussion Select an answer first