Logging Best Practices SCE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which sequence correctly represents the log management lifecycle?

   • ADisposal, Analysis, Collection, Generation
   • BAnalysis, Generation, Collection, Disposal
   • CCollection, Generation, Disposal, Analysis
   • DGeneration, Collection, Analysis, Disposal
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A SOC team is investigating a potential insider threat. They suspect that an administrator has been modifying logs to cover their tracks. The team wants to ensure that any future tampering is detected. Which measure would be most effective?

   • ASend a copy of all logs to a remote, append-only storage system that the administrator cannot access.
   • BIncrease the log verbosity to capture more details about the administrator's actions.
   • CUse a log analysis tool that automatically deletes logs older than 30 days.
   • DAssign the administrator to also manage the log monitoring system.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is required to retain logs for two years for compliance, but they are running out of storage space. The logs are currently stored on high-performance storage. The security team needs to reduce storage costs without violating the retention requirement. What is the best approach?

   • ACompress logs and store them all on high-performance storage.
   • BMove logs older than six months to lower-cost archival storage while keeping recent logs on high-performance storage.
   • CDelete logs older than one year to free up space.
   • DReduce the verbosity of logs to decrease their size.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A company is required to retain logs for 90 days for operational purposes, but a legal investigation requires logs from 6 months ago. The logs have already been deleted. What should the company do to prevent this situation in the future?

   • AIncrease the retention period to 1 year for all logs.
   • BStore logs in a separate location that is not subject to deletion.
   • CImplement a legal hold process that preserves logs relevant to ongoing investigations.
   • DRely on backups to restore deleted logs.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A SOC team is reviewing their logging strategy after a security incident. They found that the logs from a critical application were not being collected because the application's log file was overwritten daily. The team wants to prevent this from happening again. What should they implement?

   • ADisable log rotation entirely to keep all logs in a single file.
   • BStore logs only in memory to avoid disk overwrites.
   • CIncrease the log file size limit to reduce the frequency of overwrites.
   • DConfigure log rotation with a retention policy that preserves old logs before overwriting.
   Reveal Solution Discussion Select an answer first