What is the primary function of a log aggregator in a centralized log management architecture?

To encrypt logs at rest in the central repository.

To collect logs from multiple sources and forward them to a central repository for analysis.

To generate new log entries based on user activity.

To replace the need for a SIEM by providing real-time alerts.

An analyst is correlating logs from a web server and a database server. The web server log shows a SQL injection attempt in the URL. The database server log shows an error message at the same time. Which correlation would best confirm that the SQL injection succeeded?

Match the timestamp of the web server log with the database error log and correlate the error message with the injected SQL pattern.

Match the URL in the web server log with the database query text.

Match the user agent in the web server log with the database server log.

Match the source IP in the web server log with the database server log's client IP.

Which of the following is a common log source and its associated log type?

Firewall – database transaction logs

Operating system – security event logs (e.g., successful and failed logon attempts)

Application – network packet capture (PCAP) files

What is the primary function of a Security Information and Event Management (SIEM) system?

To store backups of all system files for disaster recovery.

To encrypt all network communications within an organization.

To replace the need for firewalls by analyzing network traffic.

To aggregate logs from multiple sources, correlate events, and generate alerts for potential security incidents.

Which log source is most likely to provide information about a user accessing a file on a shared network drive?

Operating system security logs on the file server

Application logs from the user's web browser

Firewall logs on the perimeter firewall

EC-CouncilSOC Essentials

Domain 5Objective 5

Logging and Log Management Tools SCE Practice Questions (Page 8)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
What is the primary function of a log aggregator in a centralized log management architecture?
Select an answer first
37expert · hard
An analyst is correlating logs from a web server and a database server. The web server log shows a SQL injection attempt in the URL. The database server log shows an error message at the same time. Which correlation would best confirm that the SQL injection succeeded?
Select an answer first
38foundation · easy
Which of the following is a common log source and its associated log type?
Select an answer first
39foundation · easy
What is the primary function of a Security Information and Event Management (SIEM) system?
Select an answer first
40foundation · easy
Which log source is most likely to provide information about a user accessing a file on a shared network drive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.