A defender notices the following in logs: a user account was locked out three times in one hour, then successfully logged in from a new IP address, and shortly after, a scheduled task was created on the same machine. The user denies any unusual activity. What is the most likely interpretation?

The user simply forgot their password and later logged in from a different device.

The logs are corrupted and cannot be trusted.

The account was compromised, and the attacker used the lockout period to guess the password, then established persistence via the scheduled task.

A misconfigured application caused the lockouts and the scheduled task is legitimate.

An analyst is reviewing firewall logs and notices a series of outbound connections from an internal server to a known malicious IP address on port 53 (DNS) at regular 5-minute intervals. The server is not configured as a DNS server. Which analysis technique would best confirm whether this is a DNS tunnel?

Check the server's CPU usage to see if it is high.

Look at the server's local firewall rules to see if port 53 is open.

Verify that the server has a static IP address.

Inspect the DNS query names and sizes in the corresponding DNS logs for the same server.

What is the primary purpose of generating regular log reports for management?

To replace the need for real-time monitoring

To provide insights into security posture and compliance

To automatically remediate security incidents

To increase log storage capacity

EC-CouncilCertified Network Defender

Domain 5Objective 2

Network Logs Monitoring and Analysis CND Practice Questions (Page 3)

Part of the Traffic and Log Monitoring and Analysis domain, which makes up ~10% of our current practice bank.

47questions here

10free pages

8concepts

Questions 11–15

11expert · hard
A defender notices the following in logs: a user account was locked out three times in one hour, then successfully logged in from a new IP address, and shortly after, a scheduled task was created on the same machine. The user denies any unusual activity. What is the most likely interpretation?
Select an answer first
12foundation · easy
A security analyst notices a log entry showing a user logging in at 3:00 AM from an IP address in a foreign country, while the user is known to be on vacation. Which log analysis technique would best help identify this as an anomaly?
Select an answer first
13application · medium
An analyst is reviewing firewall logs and notices a series of outbound connections from an internal server to a known malicious IP address on port 53 (DNS) at regular 5-minute intervals. The server is not configured as a DNS server. Which analysis technique would best confirm whether this is a DNS tunnel?
Select an answer first
14foundation · easy
What is the primary purpose of generating regular log reports for management?
Select an answer first
15foundation · easy
A network engineer needs to collect logs from a router that supports standard logging. Which protocol is commonly used to transmit these logs to a central log server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Network Logs Monitoring and Analysis CND Practice Questions (Page 3)

Questions 11–15

A defender notices the following in logs: a user account was locked out three times in one hour, then successfully logged in from a new IP address, and shortly after, a scheduled task was created on the same machine. The user denies any unusual activity. What is the most likely interpretation?

A security analyst notices a log entry showing a user logging in at 3:00 AM from an IP address in a foreign country, while the user is known to be on vacation. Which log analysis technique would best help identify this as an anomaly?

What is the primary purpose of generating regular log reports for management?

A network engineer needs to collect logs from a router that supports standard logging. Which protocol is commonly used to transmit these logs to a central log server?

Keep studying — Traffic and Log Monitoring and Analysis