Logging Best Practices SCE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is migrating from on-premises servers to a cloud environment. The security team needs to ensure that logs from cloud services are collected and managed consistently. What is the first step in the log management lifecycle they should implement?

   • AIdentify all log sources and configure them to send logs to a central collection point.
   • BDefine a retention policy for cloud logs.
   • CSet up alerting rules for cloud security events.
   • DArchive logs to cold storage immediately.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services company must retain transaction logs for seven years to meet regulatory requirements. They also need to analyze logs from the past month for a fraud investigation. The logs are currently stored on high-performance storage that is expensive. What is the most appropriate storage strategy?

   • ACompress logs and store them only on lower-cost storage from the start.
   • BDelete logs older than one month to save storage costs.
   • CKeep logs on high-performance storage for the first month, then move older logs to lower-cost archival storage.
   • DStore all logs on high-performance storage for the full seven years.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company's SIEM is generating a high volume of alerts from a legacy application that logs every user action. The SOC team is spending too much time investigating benign events. They need to reduce noise while still detecting a specific pattern of multiple failed logins followed by a successful login. What is the best approach?

   • ADisable logging for the legacy application entirely.
   • BSet all alerts to a lower severity so they are not investigated.
   • CIncrease the log retention period to allow for more historical analysis.
   • DCreate a correlation rule that only alerts when the specific pattern of multiple failed logins followed by a successful login occurs within a short time window.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A multinational company must comply with GDPR, which requires that personal data not be kept longer than necessary. However, the company also has a legal obligation to retain certain security logs for two years for a pending lawsuit. The SOC manager must design a retention policy that satisfies both requirements. What is the best approach?

   • ARetain all logs for two years to comply with the legal hold, then delete them.
   • BRetain logs for two years but pseudonymize or redact personal data where possible.
   • CStore logs indefinitely in a secure archive to avoid any compliance issues.
   • DDelete all logs immediately to comply with GDPR.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which practice is essential for continuous log monitoring to be effective?

   • AReviewing logs only after an incident occurs
   • BStoring logs only in memory for fast access
   • CDisabling alerts for known false positives
   • DDefining baseline behavior and alerting on significant deviations
   Reveal Solution Discussion Select an answer first