Logging Best Practices SCE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security analyst is investigating a suspicious login from an internal user. The authentication logs contain the username, timestamp, and source IP, but no information about the workstation or the application used. The analyst cannot determine if the login was legitimate. What is the most effective way to improve the log content for future investigations?

   • ARecord only the username and timestamp to keep logs simple.
   • BStore the logs in a proprietary format that only the SOC can read.
   • CIncrease the log retention period to 10 years.
   • DAdd device identifiers, application name, and a session ID to the authentication logs.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security team is designing a logging standard for a new microservices-based application. They want to ensure that logs from different services can be correlated to trace a single user request across the system. What should they include in the log entries?

   • AThe log level (e.g., INFO, ERROR) for each event.
   • BA unique request or transaction ID that is propagated across all services.
   • CThe timestamp in the local timezone of each service.
   • DThe server's hostname and IP address only.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security manager wants to implement logging best practices across the organization. The goal is to support incident response and compliance. Which approach best aligns with these goals?

   • ALog only failed login attempts to reduce storage costs.
   • BLog all security-relevant events with consistent, structured fields and centralize them for analysis.
   • CStore logs in a proprietary format only understood by the source system.
   • DKeep logs on each device locally and review them only when an incident occurs.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company's SIEM generates thousands of alerts per day, but most are false positives. The SOC team is missing real incidents because they are overwhelmed. What is the most effective way to improve alert quality?

   • ATune the correlation rules to reduce false positives while maintaining coverage of critical events.
   • BDisable all alerts except for critical severity.
   • CAdd more log sources to the SIEM.
   • DIncrease the log retention period to keep more data.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company is decommissioning an old server that contains logs subject to a regulatory retention period of five years. The logs are still within the retention period. The IT team wants to dispose of the server to save costs. What should the SOC recommend?

   • ADelete the logs and document that the server was decommissioned.
   • BKeep the server running solely to store the logs until the retention period ends.
   • CCompress the logs and store them on a USB drive kept in a safe.
   • DMigrate the logs to a compliant archival storage solution before decommissioning the server.
   Reveal Solution Discussion Select an answer first