A security analyst is investigating a suspected malware infection on a Windows workstation. Which log source would provide the most direct evidence of the malware's execution and persistence?

Windows Event Logs (e.g., Security, System, and Sysmon)

An analyst is investigating a possible brute-force attack on a Linux server. Which log source would provide the most direct evidence of repeated failed login attempts?

Authentication logs (e.g., /var/log/auth.log) showing failed login entries.

Application logs from the web server showing HTTP 401 responses.

System performance logs showing high CPU usage.

Firewall logs showing allowed connections to port 22.

An analyst notices that a user's workstation generated a successful login event at 02:00, followed by a VPN connection from a foreign IP at 02:05, and then a large file upload to a cloud storage service at 02:10. The user is on vacation. Which log sources are most critical to correlate to confirm a potential account compromise?

Firewall logs, DNS logs, and web proxy logs

DHCP logs, ARP logs, and NetFlow logs

Authentication logs, VPN logs, and data-loss-prevention (DLP) logs

Application logs, database logs, and file-integrity logs

A SOC team is setting up a new SIEM and wants to ensure that logs cannot be altered by attackers who compromise a source system. Which practice is most effective?

Use a shared folder on the network for log storage.

Store logs only on the source system's local disk.

Send logs immediately to a remote, write-once storage that is separate from the source system.

A SOC is evaluating a SIEM tool to replace a legacy log analyzer. The team needs to detect attacks that span multiple log sources, such as a brute-force attack on a web server followed by lateral movement to a database. Which capability is most important for this requirement?

Real-time dashboards and reporting

Correlation rules that link events across different log types

Support for syslog and JSON formats

High-volume log ingestion and storage

EC-CouncilSOC Essentials

Domain 5Objective 5

Logging and Log Management Tools SCE Practice Questions (Page 9)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 41–45

41application · medium
A security analyst is investigating a suspected malware infection on a Windows workstation. Which log source would provide the most direct evidence of the malware's execution and persistence?
Select an answer first
42application · easy
An analyst is investigating a possible brute-force attack on a Linux server. Which log source would provide the most direct evidence of repeated failed login attempts?
Select an answer first
43application · medium
An analyst notices that a user's workstation generated a successful login event at 02:00, followed by a VPN connection from a foreign IP at 02:05, and then a large file upload to a cloud storage service at 02:10. The user is on vacation. Which log sources are most critical to correlate to confirm a potential account compromise?
Select an answer first
44application · medium
A SOC team is setting up a new SIEM and wants to ensure that logs cannot be altered by attackers who compromise a source system. Which practice is most effective?
Select an answer first
45application · medium
A SOC is evaluating a SIEM tool to replace a legacy log analyzer. The team needs to detect attacks that span multiple log sources, such as a brute-force attack on a web server followed by lateral movement to a database. Which capability is most important for this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.