Events, Incidents, and Logs SCE Practice Questions (Page 8)

Questions 36–39

1. 36foundation · easy

   Which of the following scenarios best illustrates an incident rather than a single event?

   • AA server logs a normal application startup message.
   • BAn attacker performs a brute-force attack, resulting in thousands of failed login attempts followed by a successful login.
   • CA firewall blocks a single packet from an unknown IP address.
   • DA user enters an incorrect password once and is locked out of their account.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A junior analyst asks a senior analyst: 'We have a log entry showing an administrator successfully logging in at 2:00 AM, which is unusual. Is this an incident?' Which response is most accurate?

   • AIt is a log, not an event, because it was recorded by the system.
   • BIt is an incident because it is unusual behavior.
   • CIt is an incident only if the administrator was not supposed to work at that time.
   • DIt is an event that may warrant investigation, but it is not an incident until it is confirmed to have security impact.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is consolidating logs from multiple sources into a SIEM. Some sources send syslog, others send JSON, and a few send CSV. The SIEM has parsers for all three formats. The team wants to ensure that all logs are searchable and correlated. What is the most important step in the consolidation process?

   • AUse separate SIEM instances for each log format.
   • BConvert all logs to syslog format before ingestion.
   • CStore the logs in their original format and only parse them during searches.
   • DNormalize the logs into a common schema or data model during ingestion.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst sees a single log entry indicating that a user accessed a sensitive file at 2:00 PM. Later, the analyst discovers that the user's account was compromised and the file access was part of a larger data exfiltration. How should the analyst classify the single file access?

   • AIt is an event that is part of an incident.
   • BIt is an incident because it involved sensitive data.
   • CIt is an incident because it was unauthorized.
   • DIt is a log, not an event or incident.
   Reveal Solution Discussion Select an answer first