A SOC analyst discovers that a user with administrative privileges has been modifying and deleting log entries to cover their tracks. What control should be implemented to prevent this?

Increase the verbosity of the logs to capture more details.

Set a shorter retention period so logs are deleted automatically.

Enable log rotation to create smaller files.

Restrict log access to a separate, least-privilege role that does not include the ability to modify or delete logs.

A company's SOC receives thousands of security alerts per day, but most are false positives. The team is overwhelmed and has missed several genuine attacks. The SOC manager wants to improve the alerting process without adding more staff. What should the SOC do first?

Disable all alerts and rely on manual log review.

Store all logs for a longer period to enable retrospective analysis.

Tune the alert rules to reduce noise and prioritize alerts based on risk.

Increase the frequency of log collection to capture more data.

What is the primary purpose of restricting access to log files to only authorized personnel?

To comply with data minimization principles

To reduce the amount of storage space used by logs

To prevent unauthorized viewing or modification of sensitive log data

A company is designing a new logging strategy. They want to ensure that logs are useful for both real-time monitoring and historical forensics. They also need to minimize the impact on application performance. What is the best approach?

Log directly to the central system synchronously for every event.

Disable logging for performance-critical applications.

Use a lightweight agent to forward logs asynchronously to a central system, while storing a structured copy locally for short-term troubleshooting.

Store logs only in memory and not persist them to disk.

Which of the following is a core principle of effective logging in a SOC?

Logs should be deleted immediately after an incident is resolved to reduce storage costs.

Logs should be collected from as many sources as possible, even if the data is noisy or incomplete.

Logs should be stored only on the local device to prevent network exposure.

Logs should be generated in a consistent, structured format that includes sufficient context for analysis.

EC-CouncilSOC Essentials

Domain 5Objective 4

Logging Best Practices SCE Practice Questions (Page 6)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 26–30

26application · medium
A SOC analyst discovers that a user with administrative privileges has been modifying and deleting log entries to cover their tracks. What control should be implemented to prevent this?
Select an answer first
27application · medium
A company's SOC receives thousands of security alerts per day, but most are false positives. The team is overwhelmed and has missed several genuine attacks. The SOC manager wants to improve the alerting process without adding more staff. What should the SOC do first?
Select an answer first
28foundation · easy
What is the primary purpose of restricting access to log files to only authorized personnel?
Select an answer first
29expert · hard
A company is designing a new logging strategy. They want to ensure that logs are useful for both real-time monitoring and historical forensics. They also need to minimize the impact on application performance. What is the best approach?
Select an answer first
30foundation · easy
Which of the following is a core principle of effective logging in a SOC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.