A company's compliance team requires that security logs be stored in a way that prevents tampering by attackers who might gain access to the network. The logs are currently stored on the same server that generates them. Which change best addresses this requirement?

Increase the log retention period on the local server.

Forward logs to a centralized log server on a separate network segment with restricted access.

Compress the logs on the local server to save space.

Use a log analysis tool to review the logs daily.

A network administrator needs to collect logs from a legacy network device that does not support syslog or SNMP. The device has a serial console port. The administrator wants to centralize these logs in the SIEM. Which method is most practical?

Manually copy logs from the console each week and upload them to the SIEM.

Replace the device with a modern one that supports syslog.

Install an agent on the device to collect logs.

Use a serial-to-Ethernet converter that sends console output to a log collector, which then forwards to the SIEM.

A compliance officer requests a report showing that all security incidents were addressed within the required time frame. The SIEM has incident data with timestamps for detection and resolution. What is the best way to produce this report?

Provide a list of all incidents without timestamps.

Generate a report that calculates the time-to-resolution for each incident and flags any that exceeded the SLA.

Manually review each incident and write a narrative.

Only report incidents that were resolved quickly.

A security analyst sees a log entry showing a successful login from an IP address that is on a threat intelligence blocklist. What does this indicate?

A false positive that can be ignored

A configuration error in the firewall

EC-CouncilCertified Network Defender

Domain 5Objective 2

Network Logs Monitoring and Analysis CND Practice Questions (Page 5)

Part of the Traffic and Log Monitoring and Analysis domain, which makes up ~10% of our current practice bank.

47questions here

10free pages

8concepts

Questions 21–25

21application · medium
A company's compliance team requires that security logs be stored in a way that prevents tampering by attackers who might gain access to the network. The logs are currently stored on the same server that generates them. Which change best addresses this requirement?
Select an answer first
22application · medium
A network administrator needs to collect logs from a legacy network device that does not support syslog or SNMP. The device has a serial console port. The administrator wants to centralize these logs in the SIEM. Which method is most practical?
Select an answer first
23foundation · easy
Which network device typically generates logs that contain information about allowed and denied connections based on security policies?
Select an answer first
24application · medium
A compliance officer requests a report showing that all security incidents were addressed within the required time frame. The SIEM has incident data with timestamps for detection and resolution. What is the best way to produce this report?
Select an answer first
25foundation · easy
A security analyst sees a log entry showing a successful login from an IP address that is on a threat intelligence blocklist. What does this indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.