A security operations center (SOC) uses a SIEM with a limited number of alert rules. The team is overwhelmed by false positives from a rule that triggers on any failed login. They need to reduce false positives while still detecting real brute-force attacks. Which approach is most effective?

Modify the rule to trigger only when the same source IP fails authentication more than 10 times within 5 minutes.

Create a separate rule for each user account that fails to log in.

Increase the severity of the alert so analysts pay more attention to it.

Disable the failed-login alert rule entirely.

An organization's SIEM shows the following correlated events: a firewall log shows a connection from an internal IP to an external IP on port 445; a Windows security log shows a successful logon with a new account named 'support' on a domain controller; and a file integrity monitoring (FIM) log shows that the file C:\Windows\System32\drivers\etc\hosts was modified. Which conclusion is best supported?

The hosts file modification was a routine update by the IT team.

The outbound SMB connection is normal because SMB is used for file sharing.

The domain controller is compromised, and the attacker is using SMB to exfiltrate data.

The new account is a legitimate support account, and the other events are unrelated.

A security manager needs to provide a monthly report to the board about the effectiveness of the company's security monitoring. The report should show trends in security incidents and demonstrate compliance with the company's log retention policy. Which report content is most appropriate?

A technical analysis of the top 10 vulnerabilities found in the network.

A summary of incident counts by type, along with metrics on log collection completeness and retention compliance.

A list of all raw log entries from the past month, sorted by timestamp.

A copy of the SIEM alert configuration rules.

Which log entry is most likely to indicate a brute-force attack?

Multiple failed login attempts followed by a successful login

A successful login from a known IP

EC-CouncilCertified Network Defender

Domain 5Objective 2

Network Logs Monitoring and Analysis CND Practice Questions (Page 8)

Part of the Traffic and Log Monitoring and Analysis domain, which makes up ~10% of our current practice bank.

47questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A security operations center (SOC) uses a SIEM with a limited number of alert rules. The team is overwhelmed by false positives from a rule that triggers on any failed login. They need to reduce false positives while still detecting real brute-force attacks. Which approach is most effective?
Select an answer first
37foundation · easy
An organization wants to collect logs from a Windows server that does not natively support sending logs via syslog. Which method would allow the server to send its logs to a central SIEM?
Select an answer first
38expert · hard
An organization's SIEM shows the following correlated events: a firewall log shows a connection from an internal IP to an external IP on port 445; a Windows security log shows a successful logon with a new account named 'support' on a domain controller; and a file integrity monitoring (FIM) log shows that the file C:\Windows\System32\drivers\etc\hosts was modified. Which conclusion is best supported?
Select an answer first
39application · medium
A security manager needs to provide a monthly report to the board about the effectiveness of the company's security monitoring. The report should show trends in security incidents and demonstrate compliance with the company's log retention policy. Which report content is most appropriate?
Select an answer first
40foundation · easy
Which log entry is most likely to indicate a brute-force attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Network Logs Monitoring and Analysis CND Practice Questions (Page 8)

Questions 36–40

A security operations center (SOC) uses a SIEM with a limited number of alert rules. The team is overwhelmed by false positives from a rule that triggers on any failed login. They need to reduce false positives while still detecting real brute-force attacks. Which approach is most effective?

An organization wants to collect logs from a Windows server that does not natively support sending logs via syslog. Which method would allow the server to send its logs to a central SIEM?

A security manager needs to provide a monthly report to the board about the effectiveness of the company's security monitoring. The report should show trends in security incidents and demonstrate compliance with the company's log retention policy. Which report content is most appropriate?

Which log entry is most likely to indicate a brute-force attack?

Keep studying — Traffic and Log Monitoring and Analysis