Typical Log Sources and Formats SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SIEM engineer is designing a log ingestion pipeline for a large enterprise. The sources include mainframe logs in a proprietary binary format, cloud application logs in JSON, and network devices in Syslog. The SIEM has limited processing capacity and the team needs to prioritize which logs to parse first. Which approach balances security value and resource constraints?

   • AIgnore Syslog because it is plain text and less secure.
   • BParse the mainframe binary logs first because they are the most complex.
   • CParse JSON and Syslog first because they are structured and widely used, and defer binary mainframe logs until a parser is available.
   • DParse all logs in parallel to avoid delays.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A SOC analyst is investigating a security incident and has logs from a Linux server (Syslog), a Windows server (Event Log), and a cloud application (JSON). The analyst needs to correlate events across all three sources to reconstruct the attack timeline. The logs use different timestamp formats: Syslog uses 'Mar 1 10:15:30', Windows Event Log uses '2025-03-01T10:15:30.000Z', and JSON uses '2025-03-01T10:15:30Z'. What is the most effective way to correlate these events?

   • ANormalize all timestamps to a common timezone and format, such as UTC ISO 8601.
   • BManually convert each timestamp to local time before correlating.
   • CSort the logs by source name instead of time.
   • DUse the original timestamps as-is, because they are all in the same timezone.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC analyst is creating a dashboard to monitor system health and security. They want to include logs that show CPU usage, memory consumption, and disk I/O, as well as logs that show login attempts and privilege escalations. Which two log categories should the dashboard include?

   • ASecurity logs and network logs
   • BSystem logs and security logs
   • CSystem logs and application logs
   • DApplication logs and network logs
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is correlating logs from multiple sources to trace a security incident. They notice that timestamps are in different time zones. What is the best practice to ensure accurate correlation?

   • AConvert all timestamps to UTC during ingestion
   • BIgnore timestamps and rely on sequence numbers
   • CUse the SIEM's local time zone for all logs
   • DKeep the original time zones and manually adjust during analysis
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A log records successful and failed login attempts, privilege escalations, and account lockouts. Which category of logs does this belong to?

   • ANetwork logs
   • BApplication logs
   • CSystem logs
   • DSecurity logs
   Reveal Solution Discussion Select an answer first