Logging and Log Management Tools SCE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is setting up log collection from remote office firewalls to a central SIEM. The logs contain sensitive data and must not be readable if intercepted. Which configuration should they use?

   • ACompress the logs before sending them over plain syslog.
   • BSend logs in plain syslog over UDP to the SIEM.
   • CUse TLS-encrypted syslog (e.g., syslog over TLS) to the SIEM.
   • DSend logs to a staging server then forward to the SIEM over the internet in plaintext.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is reviewing logs after a suspected data breach. The firewall log shows a large outbound transfer to an external IP. The web server log shows a request from that same external IP to a URL that downloads a file. The analyst wants to determine if the file download and the outbound transfer are part of the same attack. Which additional log source would be most useful to confirm this?

   • ASystem event logs showing application crashes.
   • BDNS logs showing the hostname resolved by the external IP.
   • CProxy logs showing the HTTP request and the file download details.
   • DAuthentication logs showing user logins.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SIEM administrator is configuring ingestion for logs from a security appliance that outputs CEF format. The SIEM's default parser is for syslog. What is the best approach to handle CEF logs?

   • ASend the logs as raw syslog and let the SIEM guess the fields.
   • BConfigure the SIEM to use a CEF-specific parser or pre-process the logs to convert CEF to the SIEM's native format.
   • CAsk the appliance vendor to change the log format to syslog.
   • DStore the CEF logs in a separate database and query them manually.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary goal of log correlation in security analysis?

   • ATo identify relationships between events from different sources that together indicate a security incident.
   • BTo compress log files to reduce storage usage.
   • CTo translate logs into a single standard format.
   • DTo generate a daily summary report of all system activity.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial company must retain transaction logs for seven years to meet regulatory requirements. They also need to keep security event logs for 90 days for incident investigation. The storage budget is limited. Which storage strategy best balances compliance and cost?

   • AStore all logs in a low-cost archival tier for seven years.
   • BStore transaction logs for 90 days and security event logs for seven years.
   • CStore all logs in the same high-performance storage tier for seven years.
   • DStore transaction logs in a low-cost archival tier for seven years and security event logs in a faster tier for 90 days.
   Reveal Solution Discussion Select an answer first