4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During an incident investigation, the analyst has logs from the firewall, BIG-IP, and a compromised Linux server. The firewall log timestamps are in UTC, the BIG-IP logs are in local time (UTC-5), and the Linux server logs are in UTC. The analyst needs to determine the exact order of events. What is the first step to ensure an accurate timeline?

   • AUse the BIG-IP logs as the primary timeline since they are in local time
   • BConvert all log timestamps to a single time zone, such as UTC
   • CCheck the Linux server's uptime to estimate when the compromise occurred
   • DSort the logs by the raw timestamp strings as they appear
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which factor most directly determines how long logs should be retained?

   • ARegulatory and compliance requirements
   • BThe size of the log files
   • CThe log format used
   • DThe number of log sources
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing BIG-IP ASM logs and notices a sudden increase in requests to a login page with unusual parameters, such as 'id=1 OR 1=1'. The requests come from a single IP address that has never appeared in the logs before. Which type of log analysis would most directly identify this as a potential SQL injection attempt?

   • AReviewing the firewall logs for the same source IP
   • BCorrelating the requests with the user's Active Directory login history
   • CAnomaly detection comparing the request patterns to the baseline of normal login traffic
   • DChecking the web server's error logs for 500 status codes
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an example of correlating log events to detect a security incident?

   • AArchiving logs older than 90 days
   • BReviewing a single firewall log for denied connections
   • CMatching a failed login event on a server with a brute-force pattern from an IDS alert
   • DParsing a web server log to extract the client IP address
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SIEM analyst is correlating login failures from BIG-IP APM, a Linux server's /var/log/auth.log, and a Windows Active Directory domain controller. The BIG-IP logs use 'user', the Linux logs use 'username', and the Windows logs use 'sAMAccountName' for the same field. The analyst wants to write a single correlation rule that matches on the username across all three sources. What must be done first to make this rule work?

   • AUse a regex extraction rule in the SIEM to pull the username from the raw message of each log
   • BModify the BIG-IP, Linux, and Windows systems to output logs with identical field names
   • CCreate a separate correlation rule for each log source using its native field name
   • DConfigure the SIEM to parse and map each source's username field to a common field name, such as 'user_name'
   Reveal Solution Discussion Select an answer first