A company wants to improve detection of insider threats involving unauthorized access to sensitive files. Which log sources are most critical to enable this detection?

Application logs and database logs only

File server logs, authentication logs, and identity management logs

Firewall logs and intrusion prevention system logs

During an incident, an analyst notices that the attacker deleted some logs on the compromised server. Which action should the analyst take to preserve evidence?

Restore the server from a backup immediately.

Check if logs were forwarded to a central log management system.

Ignore the deleted logs and continue the investigation.

Reinstall the operating system to remove any malware.

During a suspected data breach, a SOC analyst needs to determine the timeline of an attacker's actions. Which log sources should the analyst prioritize to reconstruct the attack sequence?

Authentication logs, firewall logs, and application logs.

Only the logs from the compromised server.

Only the logs from the firewall.

Only the logs from the web server.

A company's SIEM is not receiving logs from a newly deployed web application firewall (WAF). The WAF supports syslog and JSON output. The SIEM's default parser expects syslog with a specific facility. Which action is most appropriate to integrate the WAF logs?

Disable the WAF logging feature because the SIEM cannot parse its format.

Manually copy WAF logs to the SIEM server daily using a script.

Configure the WAF to send syslog to the SIEM's collector and verify the facility matches the parser.

Switch the SIEM to a JSON parser and have the WAF send JSON logs directly to the SIEM database.

Which of the following is a common source of security logs?

Firewall and intrusion detection systems

EC-CouncilSOC Essentials

Domain 5Objective 1

Events, Incidents, and Logs SCE Practice Questions (Page 3)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

5concepts

Questions 11–15

11application · medium
A company wants to improve detection of insider threats involving unauthorized access to sensitive files. Which log sources are most critical to enable this detection?
Select an answer first
12expert · hard
During an incident, an analyst notices that the attacker deleted some logs on the compromised server. Which action should the analyst take to preserve evidence?
Select an answer first
13application · medium
During a suspected data breach, a SOC analyst needs to determine the timeline of an attacker's actions. Which log sources should the analyst prioritize to reconstruct the attack sequence?
Select an answer first
14application · medium
A company's SIEM is not receiving logs from a newly deployed web application firewall (WAF). The WAF supports syslog and JSON output. The SIEM's default parser expects syslog with a specific facility. Which action is most appropriate to integrate the WAF logs?
Select an answer first
15foundation · easy
Which of the following is a common source of security logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.