Logging and Log Management Tools SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company runs a mix of Linux servers, Windows workstations, and network firewalls. The SOC needs to centralize logs in a SIEM, but the firewall only supports syslog over UDP, while the SIEM expects TCP for reliable delivery. What should the team configure to ensure the firewall logs are received without loss?

   • APoint the firewall to a syslog collector that listens on UDP and forwards to the SIEM over TCP.
   • BUse a log shipper on the firewall to convert syslog to JSON and send via HTTPS.
   • CEnable TCP on the firewall and send logs directly to the SIEM.
   • DConfigure the SIEM to listen on UDP for all incoming logs.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common feature of a log analyzer tool?

   • ABlocking malicious IP addresses at the network perimeter.
   • BGenerating new log entries for applications.
   • CProviding physical security for data centers.
   • DSearching and filtering logs to find specific events or patterns.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC is comparing two log management tools: Tool A is a full SIEM with correlation and alerting; Tool B is a log analyzer that only searches and visualizes logs. The team needs to detect and alert on suspicious activity in real time. Which tool should they choose?

   • ATool B, because it is simpler and easier to use.
   • BTool A, because it provides real-time correlation and alerting.
   • CNeither tool, because log management tools cannot detect suspicious activity.
   • DBoth tools, because they complement each other.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team is integrating a new intrusion detection system (IDS) with their SIEM. The IDS can output logs in either syslog or JSON format. The SIEM's correlation engine works best with structured data. Which format should they choose and why?

   • AJSON, because it is smaller than syslog.
   • BJSON, because it provides structured key-value pairs that are easier to parse and correlate.
   • CSyslog, because it is the most widely supported standard.
   • DSyslog, because it is encrypted by default.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A healthcare organization must retain patient access logs for six years per HIPAA. They currently store logs in a SIEM with a 90-day hot storage limit. What is the best way to meet the retention requirement while keeping logs searchable?

   • AArchive logs to low-cost object storage after 90 days and load them into the SIEM for searches when needed.
   • BDelete logs after 90 days and rely on backups.
   • CExtend the SIEM's hot storage to six years.
   • DStore logs in a compressed format on the SIEM's local disk.
   Reveal Solution Discussion Select an answer first