Network Logs Monitoring and Analysis CND Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company must retain logs for 2 years for regulatory reasons but has limited storage budget. They also need to be able to quickly search logs from the last 30 days for incident response. What is the best storage strategy?

   • AStore all logs in the same fast storage for 2 years.
   • BStore recent logs in fast, searchable storage and archive older logs to cheaper, compressed storage.
   • CStore all logs in cheap, compressed storage.
   • DDelete logs older than 30 days to save space.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which practice is essential for ensuring the integrity of log data stored for compliance purposes?

   • AUsing write-once, read-many (WORM) storage
   • BCompressing log files
   • CEncrypting log files at rest
   • DStoring logs on the same server that generated them
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security analyst is investigating a potential multi-stage attack. They need to combine logs from the firewall, web server, and database server to see the full attack chain. Which process is this?

   • ALog retention
   • BLog parsing
   • CLog aggregation
   • DLog correlation
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An organization's SIEM shows the following correlated events: a firewall log shows a large outbound transfer from a server to an external IP at 2:00 AM; a database audit log shows a query that exported a large number of records at 1:55 AM; and the server's authentication log shows a login from a new admin account at 1:50 AM. The organization has a policy that requires two-factor authentication for all admin accounts. Which conclusion is best supported?

   • AThe database export was a scheduled backup, and the outbound transfer was a routine replication.
   • BThe firewall log is the only reliable indicator, and the other logs are unrelated.
   • CThe two-factor authentication policy was violated, but no data was exfiltrated.
   • DThe admin account was compromised, and data exfiltration occurred.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An organization's SIEM correlates logs from a web server, a database server, and an authentication server. An analyst sees the following: a web server log shows a SQL injection attempt in a URL parameter; a database log shows a query that returned an error about invalid syntax; and the authentication log shows no unusual activity. Which conclusion is best supported?

   • AThe SQL injection succeeded because the web server logged the attempt.
   • BThe SQL injection attempt was likely blocked because the database returned a syntax error and no authentication anomaly occurred.
   • CThe database server is down because it returned an error.
   • DThe authentication server is compromised because it did not log any activity.
   Reveal Solution Discussion Select an answer first