Logging Best Practices SCE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes the primary goal of logging in security operations?

   • ATo automatically block all malicious traffic before it reaches the network.
   • BTo replace the need for dedicated security monitoring tools.
   • CTo provide a chronological record of events that can be used for troubleshooting, auditing, and incident investigation.
   • DTo store all data indefinitely for future reference.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A multinational company must comply with data residency regulations that require logs containing personal data to remain within the country of origin. They also need to retain logs for five years for internal audit purposes. The current SIEM is hosted in a neighboring country. What is the best approach?

   • AReduce the retention period to one year to minimize the amount of personal data stored.
   • BStore all logs in the central SIEM and rely on the vendor's compliance certifications.
   • CDeploy a local log collector in each country that filters and stores personal data logs locally, while sending only non-personal metadata to the central SIEM.
   • DEncrypt all logs before sending them to the central SIEM in the neighboring country.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services company must retain transaction logs for seven years to meet regulatory requirements. The logs are currently stored on the same high-performance storage array as the production database, which is expensive and nearing capacity. The compliance team also requires that logs be retrievable within 24 hours of a request. What should the SOC recommend?

   • AStore all logs in a cloud object storage bucket with no retrieval tier configured.
   • BCompress the logs and store them on the same production array to reduce space usage.
   • CDelete logs older than one year to free up space and rely on backups for any future requests.
   • DMove logs older than 90 days to low-cost archival storage while keeping them indexed for retrieval.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is investigating a suspected breach. They need to prove that the logs they are analyzing have not been altered since they were collected. Which measure should be in place to support this?

   • AA real-time alerting rule that flags failed login attempts.
   • BA centralized log server with write-once, read-many (WORM) storage.
   • CA log rotation policy that archives logs every 24 hours.
   • DA retention policy that keeps logs for 90 days.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is decommissioning an old application server. The security team must ensure that logs from this server are handled correctly before the server is retired. What is the most important step to take?

   • AStop the logging service on the server immediately.
   • BDelete all logs from the server to free up storage space.
   • CRotate the logs one final time and leave them on the server.
   • DArchive the logs to a secure, long-term storage location before decommissioning.
   Reveal Solution Discussion Select an answer first