Logging and Log Management Tools SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a security operations context, what is the primary purpose of logging?

   • ATo replace the need for dedicated security monitoring tools by storing all system output.
   • BTo provide a chronological record of events that can be used for auditing, incident investigation, and detection of suspicious activity.
   • CTo automatically block all unauthorized access attempts in real time.
   • DTo ensure that all user actions are recorded in a format that is immediately readable by humans without any processing.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A small business is required by a client contract to retain security logs for at least one year. The business has limited IT staff and budget. Which approach best balances compliance and operational practicality?

   • AUse a cloud-based log management service that offers long-term storage and search.
   • BStore logs on a local workstation's hard drive.
   • CRetain logs only for 30 days to save money.
   • DPrint logs and store them in a filing cabinet.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's SIEM is receiving logs from a firewall that outputs CEF format and a Linux server that outputs syslog. The SIEM is having trouble parsing the syslog messages because they are not in a consistent structure. What is the best way to handle this?

   • AConfigure the SIEM to parse the syslog messages with a custom regex pattern.
   • BAsk the firewall vendor to change its output to syslog.
   • CConvert the Linux server logs to JSON format before sending to the SIEM.
   • DIgnore the syslog messages and rely only on the CEF logs.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial company must retain transaction logs for seven years to meet regulatory requirements. The logs are currently stored on fast, expensive storage. The SOC needs to reduce costs while ensuring logs remain accessible for audits. What is the most appropriate storage strategy?

   • AStore logs in memory for fast access and back up weekly.
   • BDelete logs after 90 days to reduce storage costs.
   • CCompress logs and store them on the same fast storage for seven years.
   • DMove logs older than 90 days to low-cost archival storage and keep them for seven years.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   An analyst is investigating a possible malware infection on a Windows workstation. Which log source would provide the most direct evidence of the malware executing?

   • AWindows Event Log showing process creation events (Event ID 4688).
   • BDNS log showing domain lookups.
   • CFirewall log showing outbound connections.
   • DSystem performance log showing high CPU usage.
   Reveal Solution Discussion Select an answer first