Typical Log Sources and Formats SCE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which log format is commonly associated with network devices and Linux systems, and typically includes a timestamp, hostname, and a plain-text message?

   • AXML
   • BJSON
   • CSyslog
   • DWindows Event Log
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst is reviewing logs from multiple sources in a SIEM. One log entry appears as: {"timestamp":"2025-03-01T10:15:30Z","source_ip":"192.168.1.10","event_id":4625,"message":"An account failed to log on"}. Another entry appears as: <134>Mar 1 10:15:30 webserver sshd[1234]: Failed password for root from 192.168.1.10. The analyst needs to correlate these two entries to identify a brute-force attack. Which statement accurately describes the two formats?

   • AThe first is JSON and the second is Syslog; both contain a timestamp, source, event identifier, and message.
   • BBoth are Syslog entries but with different severity levels; the first uses a modern format.
   • CThe first is Syslog and the second is JSON; the first is easier to parse because it is structured.
   • DThe first is XML and the second is Windows Event Log; the first is structured, the second is not.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A Windows administrator needs to forward security-related events from domain controllers to a SIEM. The SIEM requires a structured format that preserves event IDs and message details. Which log source and format should the administrator use?

   • ASyslog from the Windows Event Log service
   • BJSON exported from Event Viewer
   • CPlain-text log files from the Security log
   • DWindows Event Log forwarded as XML
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst is creating a dashboard to monitor the health of the IT environment. The dashboard should show: (1) failed login attempts, (2) CPU usage on servers, (3) firewall denies, and (4) application errors. Which log categories should the analyst include?

   • AOnly system and application logs
   • BOnly security and network logs
   • CSecurity logs, system logs, network logs, and application logs
   • DAll logs from every source
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A SOC analyst is investigating a possible brute-force attack. They have logs from a firewall, a web server, and a domain controller. The firewall logs show repeated connection attempts from a single IP, the web server logs show HTTP 401 responses, and the domain controller logs show many failed logon events. The analyst needs to prove that the same IP is responsible for all three. Which field is most critical for correlation?

   • AMessage text
   • BEvent ID
   • CTimestamp
   • DSource IP address
   Reveal Solution Discussion Select an answer first