4.01 Analyze Logs or Other Data Sources for Security Incidents 401 Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A financial institution is required by regulation to retain audit logs for seven years. They currently store logs in a SIEM with a hot storage tier that is expensive and only keeps data for 90 days. The compliance team needs to ensure logs are available for the full seven-year period. Which solution best meets the retention requirement while managing storage costs?

   • ACompress logs and store them on the SIEM's existing storage
   • BKeep all logs in the SIEM hot storage for seven years
   • CArchive logs to low-cost cold storage after 90 days, with the ability to retrieve them on demand
   • DDelete logs older than 90 days to reduce storage costs
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of timeline reconstruction in incident analysis?

   • ATo determine the sequence of events leading up to and during an incident
   • BTo automate log collection
   • CTo assign severity levels to logs
   • DTo predict future security incidents
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which log analysis finding would most clearly indicate a security incident?

   • AA successful login from an IP address associated with a known threat actor
   • BAn increase in web traffic during a marketing campaign
   • CA single failed login attempt due to a forgotten password
   • DA server reboot during a scheduled maintenance window
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Why is log retention important for compliance and forensic purposes?

   • ATo increase the speed of log analysis
   • BTo prevent logs from being generated
   • CTo reduce storage costs by deleting logs quickly
   • DTo ensure logs are available for investigation and legal requirements
   Reveal Solution Discussion Select an answer first