Monitoring and Logging ECDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company must comply with a regulation that requires audit logs to be retained for 7 years and be immutable. They currently store logs in a standard SIEM that allows deletion. What should they do to meet the requirement?

   • AConfigure the SIEM to forward logs to an immutable object storage (e.g., WORM storage) and set retention to 7 years.
   • BRetain logs for 1 year and then delete them to save storage costs.
   • CStore logs on a network share with write permissions for all administrators.
   • DKeep logs in the SIEM and rely on administrative controls to prevent deletion.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security operations center (SOC) is overwhelmed by alerts from their SIEM, many of which are false positives. They want to improve the signal-to-noise ratio without missing real threats. Which approach is most effective?

   • ADisable alerts for low-severity events entirely.
   • BIncrease the threshold for all alerts to reduce the number of alerts.
   • CImplement alert correlation rules that combine multiple low-severity events into a single high-severity alert.
   • DAdd more monitoring tools to collect additional data.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is required to produce an audit trail of all configuration changes made to its production servers. Which logging approach would best support this requirement?

   • AEnable system audit logs that record who made changes, when, and what was changed, and forward them to a central log server.
   • BOnly log successful changes and ignore failed attempts.
   • CKeep a manual spreadsheet where administrators log changes after they make them.
   • DStore logs locally on each server without any central aggregation.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a monitoring tool that provides dashboards and visualization for metrics?

   • AGrafana
   • BDocker
   • CAnsible
   • DKubernetes
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a best practice for implementing robust monitoring and logging?

   • AStore logs only on the local machine where they are generated
   • BDisable logging for performance reasons
   • CUse a different log format for every application
   • DCentralize logs from all systems into a single platform
   Reveal Solution Discussion Select an answer first