A security analyst is reviewing a suspicious login event from a web application. The log entry contains only a timestamp, source IP, and a message stating 'Login failed'. The analyst cannot determine which user account was targeted or whether the attempt came from a mobile device. The team wants to improve the log content to support future investigations. What should the analyst recommend?

Increase the verbosity of the application's debug logging to capture all internal stack traces.

Include the username, session ID, user agent, and a structured event ID in the log entry.

Store the raw HTTP request headers in a separate file for manual review during incidents.

Change the log format to JSON but keep the same minimal fields to avoid breaking existing parsers.

A company is subject to a regulation that requires logs to be retained for at least one year, but a pending lawsuit requires preservation of all logs related to a specific incident. The company's standard retention policy deletes logs after 90 days. What should the company do?

Delete all logs after 90 days as per the standard policy.

Place a legal hold on the incident-related logs to prevent deletion until the lawsuit is resolved.

Extend the retention period for all logs to one year.

Move the incident-related logs to a separate archive without any access controls.

Which storage solution is most appropriate for long-term log archival that must be retained for several years?

Cold storage or object storage with lifecycle policies

Local disk on the application server

Network-attached storage (NAS) on the same LAN as the application

A SOC team has implemented a centralized log management system. They want to ensure that logs cannot be altered by an attacker who gains administrative access to the system. Which combination of measures would be most effective?

Encrypt logs at rest and in transit.

Store logs on the same server as the application that generates them.

Use a single administrator account for all log management tasks.

Use WORM storage and separate administrative accounts for log management.

Which factor most directly determines the minimum log retention period for an organization?

Regulatory and compliance requirements

The preference of the security team

The storage capacity of the log server

EC-CouncilSOC Essentials

Domain 5Objective 4

Logging Best Practices SCE Practice Questions (Page 7)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 31–35

31application · medium
A security analyst is reviewing a suspicious login event from a web application. The log entry contains only a timestamp, source IP, and a message stating 'Login failed'. The analyst cannot determine which user account was targeted or whether the attempt came from a mobile device. The team wants to improve the log content to support future investigations. What should the analyst recommend?
Select an answer first
32expert · hard
A company is subject to a regulation that requires logs to be retained for at least one year, but a pending lawsuit requires preservation of all logs related to a specific incident. The company's standard retention policy deletes logs after 90 days. What should the company do?
Select an answer first
33foundation · easy
Which storage solution is most appropriate for long-term log archival that must be retained for several years?
Select an answer first
34expert · hard
A SOC team has implemented a centralized log management system. They want to ensure that logs cannot be altered by an attacker who gains administrative access to the system. Which combination of measures would be most effective?
Select an answer first
35foundation · easy
Which factor most directly determines the minimum log retention period for an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.