Logging Best Practices SCE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which measure is most effective for detecting tampering with log files?

   • ACompressing log files
   • BStoring logs in a centralized server
   • CSetting file permissions to read-only
   • DUsing cryptographic hashes or digital signatures
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's SOC team is overwhelmed by the volume of logs from firewalls and endpoints. They want to focus on meaningful security events without missing critical incidents. What should they implement first?

   • AA log retention policy that keeps logs for 30 days.
   • BA correlation rule that triggers an alert only when multiple related events occur within a short time window.
   • CA log format standardization that adds a timestamp to every entry.
   • DA log collection agent that forwards all logs to a central SIEM.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst notices that log entries from a critical database server are missing the user ID and source IP fields, making it impossible to correlate an alert with a specific account. The analyst needs to ensure future logs contain this context. What should the analyst do?

   • AIncrease the log retention period for the database server logs.
   • BEnable log rotation to create smaller, more frequent log files.
   • CUpdate the logging configuration on the database server to include the missing fields in the log format.
   • DConfigure an alert to trigger whenever the database server logs are missing user ID fields.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC team is configuring alerts for a web application. They want to detect a potential SQL injection attack. The application logs include the full URL and query parameters. Which alert rule would be most effective?

   • AAlert when a query parameter contains SQL keywords or syntax patterns, such as 'UNION SELECT' or single quotes.
   • BAlert when the URL length exceeds 100 characters.
   • CAlert when the same user accesses the application more than 10 times per hour.
   • DAlert when the application returns a 500 error.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A small business has a compliance requirement to keep authentication logs for one year. They also need to troubleshoot a recent incident that occurred three months ago. The logs are currently stored on the local disk of each server. What is the best approach?

   • ACentralize logs to a dedicated log management server with a one-year retention policy.
   • BStore logs in a cloud storage bucket without any retention policy.
   • CReduce the retention period to three months to save storage.
   • DKeep logs only on the local disks of each server for one year.
   Reveal Solution Discussion Select an answer first