A company is designing a log management program. They want to ensure logs are available for incident investigation and meet compliance requirements. Which practice is essential?

Store all logs indefinitely in their original format without any processing.

Define a log retention policy that specifies how long different log types are kept and when they are archived or deleted.

Allow each department to manage its own logs independently.

Only collect logs from critical servers to reduce storage costs.

A SOC wants to detect a brute-force attack on a VPN gateway. The SIEM receives authentication logs from the VPN. Which correlation rule technique is most appropriate?

A threshold rule that triggers when the number of failed login attempts from a single source exceeds 10 within 5 minutes

A rule that triggers when any failed login occurs

A pattern rule that looks for a successful login immediately after a failed login

An anomaly rule that compares the number of failed logins to a baseline of the user's typical behavior

A SOC is evaluating a SIEM solution. They need real-time correlation of events from multiple sources and the ability to enrich events with threat intelligence. Which SIEM capability is most important for this requirement?

A built-in correlation engine that processes events as they are ingested.

A backup and recovery plan for the SIEM itself.

A large storage capacity for historical logs.

A user-friendly dashboard for manual analysis.

EC-CouncilCertified SOC Analyst

Domain 3Objective 1

Log Management and Correlation CSA Practice Questions (Page 8)

Part of the Log Management and SIEM domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

10concepts

Questions 36–40

36foundation · easy
Which log type is primarily used to track user activities and system events for security auditing?
Select an answer first
37foundation · easy
Which of the following is an example of a network device log source?
Select an answer first
38application · medium
A company is designing a log management program. They want to ensure logs are available for incident investigation and meet compliance requirements. Which practice is essential?
Select an answer first
39application · medium
A SOC wants to detect a brute-force attack on a VPN gateway. The SIEM receives authentication logs from the VPN. Which correlation rule technique is most appropriate?
Select an answer first
40application · medium
A SOC is evaluating a SIEM solution. They need real-time correlation of events from multiple sources and the ability to enrich events with threat intelligence. Which SIEM capability is most important for this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Log Management and Correlation CSA Practice Questions (Page 8)

Questions 36–40

Which log type is primarily used to track user activities and system events for security auditing?

Which of the following is an example of a network device log source?

A company is designing a log management program. They want to ensure logs are available for incident investigation and meet compliance requirements. Which practice is essential?

A SOC wants to detect a brute-force attack on a VPN gateway. The SIEM receives authentication logs from the VPN. Which correlation rule technique is most appropriate?

A SOC is evaluating a SIEM solution. They need real-time correlation of events from multiple sources and the ability to enrich events with threat intelligence. Which SIEM capability is most important for this requirement?

Keep studying — Log Management and SIEM