A SOC analyst notices that a critical security log file has been modified by an unauthorized user. The organization wants to prevent tampering and detect any future unauthorized changes. Which measure should be implemented first?

Enable write-once, read-many (WORM) storage for the log repository.

Increase the log verbosity to capture more details about user actions.

Store logs on the same server that generates them for faster access.

Rotate logs daily to reduce the window of exposure.

A SOC team is investigating a breach and needs to prove that logs from a critical server have not been tampered with. The server's logs are currently stored on the same server that generates them. The team wants to ensure integrity going forward. Which solution provides the strongest integrity guarantee?

Forward logs in real time to a centralized, append-only storage system with cryptographic hashing.

Store logs on the same server but in a different directory.

Set the log files to read-only using file permissions.

Enable verbose logging on the server to capture more details.

A SOC team is setting up monitoring for a new application. They want to detect brute-force attacks on the login page. Which approach would be most effective?

Disable logging for the login page to reduce noise.

Store login logs in a separate database that is not monitored.

Create an alert that triggers when multiple failed login attempts occur from the same source IP within a short time window.

Log all successful logins and review them monthly.

What is the primary purpose of the disposal stage in the log management lifecycle?

To free up storage space and comply with data retention policies

To make logs available for future analysis

To move logs to a cheaper storage tier

To permanently erase all evidence of security incidents

Which field is essential in every meaningful log entry for security analysis?

Timestamp with timezone information

The hostname of the logging server

EC-CouncilSOC Essentials

Domain 5Objective 4

Logging Best Practices SCE Practice Questions (Page 3)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 11–15

11application · medium
A SOC analyst notices that a critical security log file has been modified by an unauthorized user. The organization wants to prevent tampering and detect any future unauthorized changes. Which measure should be implemented first?
Select an answer first
12expert · hard
A SOC team is investigating a breach and needs to prove that logs from a critical server have not been tampered with. The server's logs are currently stored on the same server that generates them. The team wants to ensure integrity going forward. Which solution provides the strongest integrity guarantee?
Select an answer first
13application · medium
A SOC team is setting up monitoring for a new application. They want to detect brute-force attacks on the login page. Which approach would be most effective?
Select an answer first
14foundation · easy
What is the primary purpose of the disposal stage in the log management lifecycle?
Select an answer first
15foundation · easy
Which field is essential in every meaningful log entry for security analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.