Monitoring and Logging ECDE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a recommended practice for protecting log data?

   • AEncrypt logs and restrict access to authorized personnel only
   • BDelete logs immediately after an incident is resolved
   • CStore logs in plain text without any access controls
   • DAllow all developers to modify logs to correct errors
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is investigating a potential insider threat. The user has legitimate access to sensitive data. Which monitoring approach would provide the most useful evidence?

   • AMonitor CPU usage on the user's workstation.
   • BMonitor only failed login attempts for that user.
   • CMonitor network traffic for connections to external IPs.
   • DMonitor user activity logs, including file access, data transfers, and login times, and correlate with HR data.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security operations team is investigating a potential account takeover. They have access to authentication logs, network logs, and endpoint logs. Which combination of data would provide the strongest evidence of the attack?

   • AOnly reviewing authentication logs for failed login attempts.
   • BCorrelating authentication logs showing a login from an unusual location with network logs showing a connection to a known malicious IP.
   • COnly reviewing endpoint logs for malware detection.
   • DOnly reviewing network logs for unusual traffic patterns.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A SOC analyst notices that a legitimate user's account is generating a high number of failed login attempts followed by a successful login from a different geographic location. The SIEM has a rule for impossible travel, but it has not fired. What is the most likely reason and what should be done?

   • AThe SIEM is not receiving logs from the authentication system.
   • BThe rule is configured to alert only on successful logins from two different locations within a short time window.
   • CThe user is using a VPN, which masks the true location.
   • DThe rule may require a minimum number of failed attempts before triggering; adjust the rule to consider the failed attempts and the geographic distance.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's security policy requires that logs be immutable and cannot be altered by attackers who compromise the application. They use a centralized logging platform. Which configuration is most important to meet this requirement?

   • AEnable log rotation to manage disk space.
   • BUse a separate logging account with write-once-read-many (WORM) storage and restrict delete permissions.
   • CStore logs in the same database as application data for easy access.
   • DEncrypt logs in transit using TLS.
   Reveal Solution Discussion Select an answer first