Network Logs Monitoring and Analysis CCT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security team wants to be notified immediately when a user account is locked out more than five times in ten minutes. What is the best way to implement this in a SIEM?

   • ACreate a correlation rule that counts lockout events per user and triggers an alert when the threshold is exceeded.
   • BIncrease the log retention period to ensure enough data is available.
   • CManually check the logs every morning for lockout events.
   • DSet up a daily report that lists all lockout events.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A healthcare organization collects logs that contain patient information. They need to centralize logs for analysis but must comply with privacy regulations. What is the most important consideration when implementing log collection?

   • AEncrypt logs in transit and at rest, and restrict access to authorized personnel only.
   • BRetain logs indefinitely to ensure all data is available.
   • CAnonymize logs before centralizing to remove all patient identifiers.
   • DStore logs in a public cloud for easy access.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which log source is typically used to record authentication attempts, user logins, and account management events on a Windows server?

   • AHTTP access log
   • BSyslog
   • CWindows Event Log
   • DNetFlow
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SIEM is receiving logs from multiple sources that use different timestamp formats and field names. To enable effective correlation, what should the analyst configure?

   • AIgnore logs that do not conform to the standard format.
   • BUse the original formats and rely on analysts to interpret them.
   • CSet up parsing rules to normalize timestamps and field names into a consistent schema.
   • DManually adjust each log entry to match a standard format.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which practice is essential to ensure the integrity of log data?

   • AUsing cryptographic hashing or digital signatures
   • BStoring logs in plain text for easy readability
   • CDeleting logs after 30 days
   • DAllowing all users to edit logs
   Reveal Solution Discussion Select an answer first