Events, Incidents, and Logs SCE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security appliance generates logs in a proprietary binary format. The SIEM cannot parse this format directly. What is the most appropriate action to enable analysis of these logs?

   • AConfigure the appliance to export logs in a standard format such as syslog or JSON, if supported.
   • BStore the binary logs on a separate server and only access them during investigations.
   • CDiscard the binary logs because they cannot be analyzed.
   • DManually translate each binary log into text before sending to the SIEM.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is NOT a typical source of logs for security monitoring?

   • AApplication error logs
   • BRoom temperature sensor readings
   • COperating system event logs
   • DWeb server access logs
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC is investigating a potential data breach. They have logs from the firewall, web server, and database. The firewall logs show a large outbound transfer to an external IP. The web server logs show a SQL injection attempt. The database logs show an unusual query that returned a large result set. Which statement best describes how these logs should be used?

   • ADiscard the web server logs because SQL injection is a common false positive.
   • BCorrelate the SQL injection attempt with the database query and the outbound transfer to establish a chain of events that confirms the breach.
   • CTreat each log source as an independent incident and investigate them separately.
   • DFocus only on the firewall logs because they show the data leaving the network.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is evaluating log management tools. They need to ensure that logs from different vendors can be correlated. Which approach is most effective?

   • AConvert all logs to a single proprietary format.
   • BStore logs in their original format and never modify them.
   • CUse separate tools for each vendor's logs.
   • DNormalize logs into a common format or schema during ingestion.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following best describes a 'log' in the context of security monitoring?

   • AA notification sent to a security analyst when a suspicious activity is detected.
   • BA collection of related events that indicate a security incident.
   • CA file or stream that records events with relevant details such as timestamps and source information.
   • DA single action or occurrence that is observed on a system or network.
   Reveal Solution Discussion Select an answer first