Network Logs Monitoring and Analysis CND Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network defender notices that a web server's access log shows a rapid sequence of HTTP 404 responses for URLs like /admin.php, /wp-login.php, and /backup.zip, all from the same source IP within 30 seconds. The server's error log shows no corresponding application errors. Which analysis technique would best confirm whether this is a scanning attempt rather than a user error?

   • AReview the server's system event log for application crashes that might have generated the 404s.
   • BCorrelate the 404 entries with the server's authentication log to see if any login attempts succeeded.
   • CCheck the firewall log for the same source IP to see if any outbound connections were blocked.
   • DCount the number of distinct URLs requested per second from that IP and compare with a baseline of normal user behavior.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A network defender needs to produce a weekly report for management that shows the number of security incidents detected, the average time to respond, and the percentage of logs successfully collected from all sources. Which tool feature is most appropriate for generating this report?

   • AAn ad-hoc query that lists all raw log entries for the week.
   • BA real-time dashboard that displays current alerts.
   • CA scheduled report that aggregates data over the past week and includes the required metrics.
   • DAn alert rule that notifies when a new incident is detected.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company's SIEM shows a single failed login to a domain admin account from a workstation, and separately, a firewall log shows a large outbound data transfer from that workstation to an external IP. No other alerts have fired. The defender must decide whether to escalate this as a potential incident. What is the most appropriate next step?

   • ABlock the external IP and close the case.
   • BCorrelate the workstation's authentication logs with the firewall log to see if the failed login and data transfer share a common process or user session.
   • CIgnore the events because a single failed login and a data transfer are not indicative of an attack.
   • DEscalate immediately based on the outbound data transfer alone.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company has a mix of Linux and Windows servers. They want to centralize logs with minimal overhead and without relying on third-party agents. Which collection method is most appropriate?

   • AUse SNMP traps from both Linux and Windows servers.
   • BInstall a third-party agent on all servers.
   • CHave the central server pull logs via SSH from Linux and WinRM from Windows.
   • DUse syslog on Linux and configure Windows Event Forwarding (WEF) to a central collector.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which log analysis technique involves looking for specific known indicators of compromise, such as a malicious IP address or file hash, in log entries?

   • ABaselining
   • BPattern matching
   • CLog aggregation
   • DLog retention
   Reveal Solution Discussion Select an answer first