Network Logs Monitoring and Analysis CND Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary benefit of aggregating logs from multiple sources into a central repository?

   • AIt eliminates the need for log analysis tools
   • BIt automatically detects all security incidents
   • CIt makes it easier to search and analyze all logs in one place
   • DIt reduces the need for log retention policies
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small company cannot afford a full SIEM but needs to centralize logs from multiple servers and perform basic pattern searches for anomalies. Which tool combination would be most appropriate?

   • ADeploy an enterprise SIEM with automated correlation rules.
   • BUse only Windows Event Viewer on each server.
   • CUse a syslog server with grep and awk for manual analysis.
   • DUse a network packet analyzer to capture all traffic.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of establishing a log retention policy?

   • ATo increase log collection speed
   • BTo reduce the size of log files
   • CTo encrypt log data
   • DTo comply with legal and regulatory requirements
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company has a mix of Linux servers, Windows servers, and network devices. The security team wants to centralize log collection without installing agents on every system. Which collection method is most appropriate for this heterogeneous environment?

   • AUse SNMP traps for all systems.
   • BUse a central log collector that only supports syslog.
   • CInstall a proprietary agent on every system.
   • DUse syslog for Linux servers and network devices, and Windows Event Forwarding for Windows servers.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company must retain security logs for at least one year to meet a regulatory requirement. The SIEM storage is limited, and the compliance team wants to reduce costs. The security team needs to be able to search logs from the past 90 days quickly for incident response. Which storage strategy best balances compliance, cost, and operational needs?

   • AStore all logs in the SIEM hot storage for one year to ensure fast search at all times.
   • BCompress all logs and store them on the SIEM for one year, accepting slower search performance.
   • CKeep logs in fast, searchable storage for 90 days, then move older logs to cheaper archival storage that is still retrievable.
   • DDelete logs older than 90 days to save storage and rely on backups for compliance.
   Reveal Solution Discussion Select an answer first