Logging and Log Management Tools SCE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC analyst is investigating a potential insider threat. The company's SIEM shows that a user's account was used to access a sensitive file server at 3:00 AM. The user's workstation was off at that time. The analyst also sees a VPN login from the user's credentials at 2:55 AM from an IP address that is not the user's home IP. Which conclusion is most supported by the evidence?

   • AThe user is working remotely from a new device.
   • BThe user's credentials are compromised and being used from another location.
   • CThe user is an insider threat.
   • DThe file server logs are inaccurate.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational company needs to aggregate logs from all regional offices into a central SIEM. Some offices have low-bandwidth connections, and logs must be transmitted securely. The team is considering using a log shipper that compresses logs and sends them over TLS. What is the primary benefit of this approach?

   • AIt guarantees log delivery even if the network is down.
   • BIt automatically normalizes all logs to a single format.
   • CIt eliminates the need for a central SIEM.
   • DIt reduces bandwidth usage while maintaining confidentiality and integrity.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is reviewing logs and notices that a server's authentication log shows multiple failed logins from a single IP, followed by a successful login. Which additional log source would best help determine if the successful login was malicious?

   • AApplication logs from the server
   • BDNS logs
   • CHardware inventory logs
   • DDHCP logs
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which log format is a standardized, text-based protocol commonly used to send event messages over UDP or TCP to a central log collector?

   • ACEF
   • BXML
   • CJSON
   • DSyslog
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which method is commonly used to collect logs from network devices that only support syslog?

   • AInstall an agent on the device to read local log files.
   • BUse a packet sniffer to capture syslog traffic.
   • CManually export logs via USB drives.
   • DConfigure the devices to send syslog messages to a central syslog server.
   Reveal Solution Discussion Select an answer first