Typical Log Sources and Formats SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is writing a parser for a new log source. The log entries look like this: <134>Mar 1 10:15:30 webserver sshd[1234]: Failed password for root from 192.168.1.10. The analyst needs to extract the timestamp, hostname, process name, and message. Which parsing approach is most appropriate?

   • AUse a Windows Event Log reader because the log is from a Windows system.
   • BUse a regular expression to parse the Syslog header and message.
   • CUse a JSON parser because the log is structured.
   • DUse an XML parser because the log is XML.
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   An analyst is reviewing a log entry that contains the following fields: '2025-03-01T12:34:56Z', 'server01', '4625', and 'An account failed to log on'. Which field represents the event ID?

   • A4625
   • Bserver01
   • C2025-03-01T12:34:56Z
   • DAn account failed to log on
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC analyst is investigating a possible brute-force attack. The analyst has Syslog logs from a Linux server and Windows Event Logs from a domain controller. The Syslog logs show repeated failed SSH logins, and the Windows logs show repeated failed logon attempts. The analyst needs to determine if the attacks are coming from the same source IP. What is the best way to correlate the logs?

   • AExtract the source IP field from both log formats and compare them.
   • BCompare the timestamps of the events to see if they occurred at the same time.
   • CUse the message text to identify the source IP.
   • DCompare the event IDs from both sources.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A SOC analyst is reviewing the sources that generate logs in a typical enterprise environment. Which of the following is a common log source that records authentication and access events on a Windows workstation?

   • AOperating system
   • BFirewall
   • CWeb application
   • DNetwork switch
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is building a centralized log pipeline and needs to ingest logs from a mix of Linux servers, a Cisco ASA firewall, and a custom Java application. The Linux servers and the firewall both support sending logs over UDP port 514, while the Java application writes structured logs to a file. The analyst wants to minimize the number of different ingestion methods and preserve the original log content. Which approach best meets these requirements?

   • AHave the Java application write directly to the Syslog port using a custom UDP socket, and disable file-based logging.
   • BInstall a Windows Event Log forwarder on the Linux servers and firewall, and convert the Java logs to XML before sending.
   • CConfigure the Linux servers and firewall to send Syslog to the collector, and use a filebeat agent to forward the Java application logs.
   • DUse a single Syslog collector for all sources, and configure the Java application to send its logs via Syslog over TCP.
   Reveal Solution Discussion Select an answer first