Network Logs Monitoring and Analysis CND Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of tool is specifically designed to collect, correlate, and analyze security logs from multiple sources in real time?

   • ASIEM
   • BPacket analyzer
   • CVulnerability scanner
   • DPort scanner
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A defender sees a log entry showing a successful login to a server from an internal IP at 2:00 AM, followed by the execution of a command that downloads a file from an external site. The user associated with the account is on vacation. What is the most appropriate immediate action?

   • ASend an email to the user asking if they logged in.
   • BReboot the server to clear any malware.
   • CDisable the user account and isolate the server from the network while preserving the logs.
   • DIgnore the event because the user might have returned early.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A compliance auditor requires a monthly report showing all administrative access to critical servers, including who, when, and from where. The logs are already centralized. What is the most efficient way to produce this report?

   • ACreate a query that filters for administrative logon events and schedule it to run monthly, exporting the results to a report.
   • BEnable verbose logging on all servers and store the logs indefinitely.
   • CManually review all logs at the end of each month and compile the report.
   • DAsk the system administrators to provide their own access logs.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is reviewing a web server's access log and sees a pattern where a single IP requests the same URL with different query parameters, such as /search?q=test, /search?q=admin, /search?q=password. The requests occur within a few seconds. Which analysis technique would best identify this as a potential information disclosure attempt?

   • ACheck the server's error log for 500 status codes.
   • BCompare the query parameters against a list of sensitive keywords like 'admin', 'password', and 'backup'.
   • CLook at the user-agent string to identify the attacker's browser.
   • DCount the total number of requests from that IP in the last hour.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team must retain firewall logs for 12 months to meet a compliance requirement, but storage space is limited. The logs are currently stored in plain text on a local server. Which approach best balances compliance, storage, and security?

   • AKeep the logs on the local server but change the file extension to .log.bak.
   • BStore the logs in a cloud bucket with no additional configuration.
   • CCompress the logs and store them on a write-once, read-many (WORM) storage system with access controls.
   • DDelete logs older than 6 months to free up space.
   Reveal Solution Discussion Select an answer first