A junior analyst is investigating a security incident and opens a Windows Event Log entry that shows Event ID 4625, Source: Microsoft-Windows-Security-Auditing, TimeCreated: 2025-03-01T10:15:30.000Z, and a message that includes the account name and source IP. The analyst needs to determine which account was targeted. Which field in the log entry provides this information?

The Source field, because it indicates which account was used.

The Event ID field, because 4625 uniquely identifies the account name.

The message field, because it contains the account name and other details of the failed logon.

The TimeCreated field, because it shows when the account was locked.

A SOC analyst is setting up log collection for a new office. The office has Windows workstations, a Linux file server, a network printer, and a smart thermostat. The analyst needs to collect logs that are useful for security monitoring. Which sources should the analyst prioritize?

Network printer and smart thermostat

All sources equally, because every device can be compromised

Windows workstations and the Linux file server

Only the smart thermostat, because it is an IoT device

A SOC analyst is categorizing logs from various sources for a compliance report. The sources include a firewall, a web server, a domain controller, and an antivirus console. Which categorization correctly matches each source to its primary log type?

Firewall: application log; web server: network log; domain controller: system log; antivirus: application log

Firewall: network log; web server: application log; domain controller: security log; antivirus: security log

Firewall: security log; web server: system log; domain controller: application log; antivirus: network log

Firewall: system log; web server: security log; domain controller: network log; antivirus: system log

EC-CouncilSOC Essentials

Domain 5Objective 2

Typical Log Sources and Formats SCE Practice Questions (Page 1)

Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 1–5

1application · medium
A junior analyst is investigating a security incident and opens a Windows Event Log entry that shows Event ID 4625, Source: Microsoft-Windows-Security-Auditing, TimeCreated: 2025-03-01T10:15:30.000Z, and a message that includes the account name and source IP. The analyst needs to determine which account was targeted. Which field in the log entry provides this information?
Select an answer first
2foundation · easy
A log contains entries about firewall rule hits, dropped packets, and connection attempts to specific ports. Which category of logs does this represent?
Select an answer first
3application · medium
A SOC analyst is setting up log collection for a new office. The office has Windows workstations, a Linux file server, a network printer, and a smart thermostat. The analyst needs to collect logs that are useful for security monitoring. Which sources should the analyst prioritize?
Select an answer first
4expert · hard · select all that apply
A company is deploying a new SIEM and needs to ensure comprehensive visibility. They have a limited budget and must choose which log sources to onboard first. Which two log sources provide the most critical security visibility for early threat detection? Select all that apply.
Select an answer first
5application · medium
A SOC analyst is categorizing logs from various sources for a compliance report. The sources include a firewall, a web server, a domain controller, and an antivirus console. Which categorization correctly matches each source to its primary log type?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Typical Log Sources and Formats SCE Practice Questions (Page 1)

Questions 1–5

A log contains entries about firewall rule hits, dropped packets, and connection attempts to specific ports. Which category of logs does this represent?

A SOC analyst is setting up log collection for a new office. The office has Windows workstations, a Linux file server, a network printer, and a smart thermostat. The analyst needs to collect logs that are useful for security monitoring. Which sources should the analyst prioritize?

A company is deploying a new SIEM and needs to ensure comprehensive visibility. They have a limited budget and must choose which log sources to onboard first. Which two log sources provide the most critical security visibility for early threat detection? Select all that apply.

A SOC analyst is categorizing logs from various sources for a compliance report. The sources include a firewall, a web server, a domain controller, and an antivirus console. Which categorization correctly matches each source to its primary log type?

Keep studying — Log Management