Network Logs Monitoring and Analysis CCT Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   When troubleshooting a network connectivity issue, which log would provide the most direct evidence of a packet being dropped by a security policy?

   • AApplication log
   • BWeb server access log
   • CFirewall log
   • DSystem event log
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A multinational company must collect logs from employees in the EU and store them in a central repository in the US. The logs contain personal data. What is the most important consideration to ensure compliance with GDPR?

   • AEnsure the data transfer is lawful, such as using Standard Contractual Clauses or an adequacy decision.
   • BAnonymize all personal data before transfer.
   • CStore the logs only in the EU to avoid transfer issues.
   • DEncrypt the logs at rest and in transit.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the purpose of log normalization in a SIEM system?

   • ATo convert heterogeneous log formats into a common, consistent structure
   • BTo compress log files to save storage space
   • CTo delete duplicate log entries
   • DTo encrypt logs for secure transmission
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An analyst is investigating a potential data breach. The firewall logs show outbound traffic to an unusual external IP address, and the DNS logs show a query for a domain that resolves to that IP. What should the analyst do to confirm the breach?

   • ABlock the external IP address immediately.
   • BCheck the web server logs for access to the domain.
   • CReview the IDS logs for alerts on the external IP.
   • DCorrelate the firewall and DNS logs with the internal host's logs to identify which device initiated the traffic.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A financial company must retain transaction logs for 7 years to meet regulatory requirements, but also needs to respond quickly to incident investigations. The logs are currently stored on local disks that are nearing capacity. What is the most appropriate storage strategy?

   • ACompress all logs and store them on the same local disks to save space.
   • BStore all logs on the local disks and delete older logs when space runs out.
   • CSend all logs to a cloud-based SIEM and rely on the vendor's default retention period.
   • DUse a tiered storage approach: keep recent logs on fast local storage for quick access, and archive older logs to cheaper object storage with a retention policy that enforces the 7-year period.
   Reveal Solution Discussion Select an answer first