Events, Incidents, and Logs SCE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's SIEM receives logs from multiple sources, but the timestamps are inconsistent: some are in UTC, some in local time, and some have no timezone information. This is causing correlation errors. What is the most effective solution?

   • AUse the SIEM's receipt time instead of the log's timestamp for correlation.
   • BIgnore the timestamp issue and rely on the order logs are received.
   • CManually adjust timestamps in the SIEM for each source.
   • DConfigure the SIEM to normalize all timestamps to UTC during ingestion and ensure source devices are configured to send UTC.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is required to retain logs for regulatory compliance. They currently store logs in a SIEM for 30 days and then delete them. The regulation requires 1 year of retention. The SIEM storage is expensive, and the company wants to minimize costs. Which approach is most appropriate?

   • AIncrease the SIEM retention period to 1 year regardless of cost.
   • BDelete logs after 30 days and rely on backups for compliance.
   • CStore logs in a compressed format on the SIEM to reduce storage usage.
   • DArchive logs to a low-cost storage solution after the SIEM retention period, while keeping them easily retrievable for investigations.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is setting up a central log management system. The security team wants to collect logs from a firewall, a Windows domain controller, and a custom web application. The web application outputs JSON logs, while the firewall and domain controller support syslog. Which approach best consolidates these logs for analysis?

   • AStore the firewall and domain controller logs in their native formats and only forward the web application logs to the central system.
   • BConfigure all three sources to send logs in JSON format directly to the central system.
   • CUse a separate log management system for each source to avoid format conversion.
   • DConfigure the firewall and domain controller to send syslog to the central system, and configure the web application to send its JSON logs via an agent that converts them to syslog.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company experiences a malware infection on a workstation. The SOC analyst needs to trace how the malware entered the network. Which combination of log sources would be most useful for this investigation?

   • AOnly the firewall logs.
   • BProxy logs, email gateway logs, and endpoint detection logs.
   • COnly the workstation's system event logs.
   • DOnly the DNS logs.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During an investigation, an analyst correlates a failed login event on a domain controller with a successful login event from the same account 10 minutes later, followed by a data exfiltration alert from the DLP system. Which statement best describes how these logs contribute to incident detection?

   • AThe logs are only useful for auditing and cannot be used for incident detection.
   • BThe logs provide a sequence of events that together reveal a security incident, such as a brute-force or credential compromise.
   • CThe logs prove that the account was compromised and no further investigation is needed.
   • DThe logs are all separate incidents that must be investigated independently.
   Reveal Solution Discussion Select an answer first