EC-CouncilSOC Essentials
Domain 5Objective 2
Typical Log Sources and Formats SCE Practice Questions (Page 8)
Part of the Log Management domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)
37questions here
8free pages
4concepts
Questions 36–37
- 36
A security analyst is reviewing a suspicious log entry from a web server. The entry is: 192.168.1.10 - - [01/Mar/2025:10:15:30 +0000] "GET /admin.php?user=admin&pass=1234 HTTP/1.1" 200 512. The analyst suspects a credential theft attempt. Which fields in this log entry are most critical for confirming the suspicion?
Select an answer first - 37
A SOC analyst is investigating a potential data exfiltration and finds a log entry in a proxy server log that includes: timestamp, source IP, destination URL, and bytes sent. The analyst needs to determine the amount of data that was uploaded. Which field should the analyst examine?
Select an answer first
Finished these 2 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to SCE
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.