Logging Best Practices SCE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary advantage of using a structured log format such as JSON or CEF?

   • AIt makes logs human-readable without any parsing.
   • BIt ensures logs cannot be altered by attackers.
   • CIt reduces the storage size of log files.
   • DIt allows automated tools to parse and correlate fields consistently.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's security policy requires that logs be protected from unauthorized access. The logs contain sensitive customer information. Which access control measure should be implemented?

   • AEncrypt logs but allow all employees to decrypt them.
   • BStore logs on a shared network drive with write access for everyone.
   • CRestrict access to logs to only the SOC team and use role-based access control (RBAC).
   • DMake logs publicly readable to simplify sharing with auditors.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the main purpose of setting up alerting rules on log data?

   • ATo reduce the volume of logs collected
   • BTo notify security personnel of potential incidents in a timely manner
   • CTo automatically fix security issues
   • DTo replace the need for manual log review
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC team is implementing a new alerting system. They want to ensure that alerts are not missed during off-hours. They also want to avoid alert fatigue. What is the best approach?

   • ADisable alerts during off-hours to avoid disturbing staff.
   • BSet all alerts to the same severity level.
   • CUse an escalation policy that alerts the on-call analyst first and escalates to a supervisor if not acknowledged within a set time.
   • DSend every alert to all SOC team members via email.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst is building a detection rule that correlates failed logins across multiple systems. The logs are in different formats: some are JSON, some are CSV, and some are syslog. The analyst needs to ensure the rule works consistently. What is the most important step?

   • ACreate separate rules for each log format.
   • BConvert all logs to a single format such as JSON.
   • CNormalize the logs into a common schema with consistent field names before applying the correlation rule.
   • DIncrease the log retention period to ensure enough data is available.
   Reveal Solution Discussion Select an answer first