Typical Log Sources and Formats SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is triaging alerts and sees the following log entries: (1) a firewall log showing a denied inbound connection from an external IP, (2) an application log showing a failed database login, (3) a Windows event log showing a successful user logon, and (4) a Linux system log showing a disk warning. The analyst needs to prioritize which logs are most relevant to a potential network intrusion. Which combination of log categories should the analyst focus on first?

   • AAll logs equally, because each category is equally important
   • BOnly the firewall log, because it is the only network log
   • CApplication logs (database) and system logs (disk warning)
   • DNetwork logs (firewall) and security logs (Windows event log)
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is required to retain security-related logs for at least one year for compliance. The log sources include: Windows security event logs, Linux authentication logs, firewall logs, and application debug logs. The storage budget is limited. Which logs should the company prioritize for long-term retention?

   • AOnly the firewall logs, because they show all network traffic
   • BWindows security logs, Linux authentication logs, and firewall logs
   • CAll logs equally, because compliance requires all logs
   • DApplication debug logs, because they contain detailed error messages
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is setting up a new SIEM and needs to prioritize log sources for early threat detection. They have limited budget and can only onboard a few sources initially. Which combination of log sources would provide the broadest security visibility?

   • ADatabase, file server, and backup server
   • BFirewall, domain controller, antivirus, and web server
   • CPrint server, DNS server, and DHCP server
   • DRouter, switch, and load balancer
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A log entry is formatted as a series of key-value pairs enclosed in curly braces, such as {"host":"server1","event":"login"}. Which log format does this represent?

   • AXML
   • BJSON
   • CSyslog
   • DWindows Event Log
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC analyst is building a detection rule for lateral movement. The rule should trigger when a user logs into multiple workstations within a short time. The available logs are: Windows security logs (logon events), firewall logs (network connections), and application logs (business applications). Which log source is most appropriate for this rule?

   • AWindows security logs, because they contain logon events with user and workstation information.
   • BFirewall logs, because they show network connections between workstations.
   • CApplication logs, because they show user activity in business applications.
   • DAll three sources, because lateral movement involves all of them.
   Reveal Solution Discussion Select an answer first