Events, Incidents, and Logs SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a common log format used for network device logs?

   • ASyslog
   • BHTML
   • CPDF
   • DMP3
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team needs to ingest logs from a mix of network devices that support syslog and cloud applications that output JSON. The SIEM can parse both formats. What is the primary consideration when configuring the ingestion pipeline?

   • ASend all logs to a single collector regardless of format, and let the SIEM auto-detect everything.
   • BEnsure each log source is configured to send to the correct collector and that the SIEM uses the appropriate parser for each format.
   • CConvert all logs to a single proprietary format before sending them to the SIEM.
   • DOnly ingest syslog logs because JSON is not a standard log format.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a structured log format that is commonly used for application logs?

   • APlain text
   • BCSV
   • CBinary
   • DJSON
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During an incident investigation, an analyst needs to prove that an attacker accessed a specific file on a server. The server's file access logging is not enabled. Which alternative log source could provide evidence of the file access?

   • AApplication logs that record file operations.
   • BFirewall logs showing traffic to the server.
   • CRouter logs showing packet counts.
   • DDNS logs showing queries from the server.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC is investigating a ransomware attack. They have logs from the firewall, endpoint, and backup system. The firewall logs show outbound connections to a known C2 server. The endpoint logs show the ransomware executable running. The backup logs show that backups were deleted. Which statement best describes the role of these logs in the investigation?

   • AThe logs together provide a timeline of the attack, including initial compromise, C2 communication, and impact on backups.
   • BThe backup logs are irrelevant because the backups were deleted.
   • CThe endpoint logs are the only ones that matter because they show the ransomware executable.
   • DThe firewall logs are the only ones that matter because they show the C2 connection.
   Reveal Solution Discussion Select an answer first