Logging and Log Management Tools SCE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is JSON a popular format for modern log management systems?

   • AIt is human-readable and supports structured key-value pairs that are easy to parse and index.
   • BIt is a proprietary format used only by Microsoft products.
   • CIt is a binary format that minimizes storage space.
   • DIt automatically encrypts log data in transit.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is choosing between two log management tools: Tool A is a SIEM with built-in correlation rules but requires agents on every server. Tool B is a log aggregator that accepts syslog and has a query interface but no correlation engine. The team has limited administrative time and needs to detect attacks across servers. Which tool is more appropriate?

   • ATool A, but only if the agents are installed on critical servers.
   • BTool B, because syslog is more secure than agents.
   • CTool A, because the correlation engine will automatically detect attacks.
   • DTool B, because it is easier to deploy without agents.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization is investigating a data breach. They have logs from the firewall, web server, and database. Which log source is most likely to reveal the exact data that was exfiltrated?

   • ADNS logs
   • BWeb server logs
   • CFirewall logs
   • DDatabase audit logs
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is investigating a potential data exfiltration. The firewall logs show a large outbound transfer to an external IP. The proxy logs show a user downloading a file from a file-sharing site. The authentication logs show the user logged in at the same time. Which correlation would provide the strongest evidence that the user is responsible?

   • AMatch the external IP in the firewall logs with the proxy logs.
   • BMatch the user's workstation IP in the firewall logs with the proxy logs and authentication logs.
   • CMatch the file size in the proxy log with the outbound transfer size in the firewall log.
   • DMatch the timestamp of the authentication log with the firewall log.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of using log analysis to detect a security incident?

   • AReviewing authentication logs to identify multiple failed logon attempts followed by a successful logon from the same source IP.
   • BChecking the system uptime to ensure the server has not rebooted.
   • CVerifying that log files are being written to the correct directory.
   • DCounting the number of log entries per day to estimate storage growth.
   Reveal Solution Discussion Select an answer first