Events, Incidents, and Logs SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst notices a spike in failed logins for a service account, followed by a successful login from a new IP address. The analyst creates a ticket. Which step should the analyst take next to determine if this is an incident?

   • AImmediately block the new IP address and close the ticket.
   • BCorrelate the successful login with other logs, such as data access or privilege changes, to assess security impact.
   • CReset the service account password and consider the issue resolved.
   • DIgnore the event because failed logins are common and the successful login could be legitimate.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is investigating a potential brute-force attack on a web application. Which log source would provide the most direct evidence of the attack?

   • AWeb server access logs.
   • BDNS logs.
   • CFirewall logs.
   • DOperating system event logs.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an investigation, an analyst finds that a user's account was used to log in from two different countries within 5 minutes. The analyst checks VPN logs and finds that the user has a valid VPN session from the first country. What is the most likely conclusion?

   • AThe account is definitely compromised, and the user's password should be reset immediately.
   • BThe second login may be a sign of credential compromise, but further correlation with other logs is needed to confirm.
   • CThe logs are unreliable because authentication logs cannot be used for incident detection.
   • DThe login is a false positive because the user has a valid VPN session.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC team is integrating a new cloud-based application that sends logs in JSON format. The existing on-premises SIEM expects syslog. The team wants to minimize data loss and preserve the structured data. What is the best approach?

   • AAsk the cloud provider to send syslog instead of JSON.
   • BConvert the JSON logs to syslog using a script before sending them.
   • CStore the JSON logs in a separate database and do not integrate them.
   • DUse a log shipper that forwards the JSON logs to the SIEM, and configure the SIEM to parse JSON.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC analyst is reviewing logs and finds a single failed login attempt from a known malicious IP address. No other related activity is found. According to standard definitions, how should this be classified?

   • AAs an event, because it is a single occurrence with no confirmed security impact.
   • BAs an incident, because the IP is known malicious.
   • CAs a log, not an event or incident.
   • DAs an incident, because it is a security-relevant event.
   Reveal Solution Discussion Select an answer first