Events, Incidents, and Logs SCE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A SOC analyst is investigating a possible data exfiltration. The analyst has access to firewall logs, proxy logs, and DNS logs. Which combination of logs would provide the most complete evidence of data leaving the network?

   • AOnly DNS logs.
   • BOnly proxy logs.
   • COnly firewall logs.
   • DProxy logs and firewall logs.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   During an incident investigation, what is the primary role of logs?

   • ATo prevent the incident from recurring by changing firewall rules.
   • BTo automatically remediate the vulnerability that caused the incident.
   • CTo encrypt all data involved in the incident to protect it from further compromise.
   • DTo provide evidence of what occurred, including timestamps and source details.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC is building a log management strategy. They want to ensure they can detect a malware infection that spreads via email attachments. Which combination of log sources is most essential for this detection?

   • ADNS logs and DHCP logs only
   • BEmail gateway logs, endpoint logs, and authentication logs
   • CApplication logs and database logs only
   • DFirewall logs and router logs only
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC team is integrating a new security tool that outputs logs in JSON format. The existing log management system primarily expects syslog. What is the most efficient way to incorporate the JSON logs?

   • AConfigure the log management system to parse JSON directly, in addition to syslog.
   • BStore the JSON logs separately and do not integrate them.
   • CAsk the vendor to change the tool to output syslog.
   • DConvert the JSON logs to syslog using a script before sending them.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is required to retain logs for two years for compliance. The log management system is running out of storage. Which approach balances compliance requirements with storage constraints?

   • AReduce logging verbosity to save space.
   • BArchive older logs to cheaper storage while keeping them easily retrievable.
   • CDelete logs older than six months to free up space.
   • DCompress logs and store them on the same system.
   Reveal Solution Discussion Select an answer first