A SOC team needs to centralize logs from 200 Windows servers, 50 Linux servers, and several network appliances. The SIEM is hosted in a cloud environment, and the team wants to minimize the configuration burden on each source while ensuring logs are sent securely. Which approach should they use?

Manually copy log files from each server to a shared network share that the SIEM polls periodically.

Install a lightweight forwarder on each server and configure the network appliances to send syslog to the SIEM collector.

Enable SNMP traps on all devices and configure the SIEM to receive traps as the primary log source.

Use a central syslog server only for Linux and network devices, and skip Windows logs to reduce complexity.

Which correlation use case is most appropriate for detecting a brute-force attack on a web application?

Alerting on a single failed login attempt

Alerting when a user successfully logs in from a new device

Alerting when the web server CPU usage is high

Alerting when the number of failed login attempts from a single source IP exceeds a threshold within a short time window

A SIEM is receiving logs from a custom application that uses a non-standard timestamp format. The SOC cannot correlate events from this application with others. What should the team do?

Store the logs without parsing and search them manually.

Create a custom parser to extract and convert the timestamp into the SIEM's standard format.

Ask the application vendor to change the timestamp format to ISO 8601.

Ignore the timestamp and rely on the SIEM's ingestion time.

Which factor is most important when determining log retention periods?

The speed of the log collection process

Compliance requirements and organizational security needs

The storage capacity of the log management system

The number of log sources in the environment

EC-CouncilCertified SOC Analyst

Domain 3Objective 1

Log Management and Correlation CSA Practice Questions (Page 6)

Part of the Log Management and SIEM domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

10concepts

Questions 26–30

26application · medium
A SOC team needs to centralize logs from 200 Windows servers, 50 Linux servers, and several network appliances. The SIEM is hosted in a cloud environment, and the team wants to minimize the configuration burden on each source while ensuring logs are sent securely. Which approach should they use?
Select an answer first
27foundation · easy
Which correlation use case is most appropriate for detecting a brute-force attack on a web application?
Select an answer first
28application · medium
A SIEM is receiving logs from a custom application that uses a non-standard timestamp format. The SOC cannot correlate events from this application with others. What should the team do?
Select an answer first
29foundation · easy
Which factor is most important when determining log retention periods?
Select an answer first
30foundation · easy
Which component of a SIEM is responsible for parsing raw log data into a normalized format?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.