Which type of event would typically be captured in an audit log?

The total amount of disk space available on a server

A user successfully logging into a system

The current CPU temperature of a server

The color scheme of the desktop background

Which storage solution is most appropriate for long-term retention of audit logs that must be preserved for several years?

Write-once, read-many (WORM) storage

A security analyst is reviewing authentication logs and notices that a single user account has had 500 failed login attempts over the past hour from a single IP address. Which analysis technique would be most effective to determine whether this is a brute-force attack or a user who forgot their password?

Check whether the failed attempts are followed by a successful login from the same IP address, and compare the timing and source IP to the user's typical behavior.

Count the total number of failed attempts across all users to see if the system is under a distributed attack.

Review the user's recent password change history to see if they have changed passwords frequently.

Immediately block the IP address to prevent further attempts.

What is the primary purpose of generating regular reports from audit logs?

To provide evidence of compliance and support management decisions

To replace the need for real-time monitoring

To increase the volume of logs collected

To automatically block malicious IP addresses

Which of the following is an example of a policy violation that could be detected through audit log analysis?

A user changing their desktop wallpaper

A user accessing a file outside of their normal working hours

GIAC Critical Controls Certification

Domain 5Objective 1

Audit Log Management GCCC Practice Questions (Page 2)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
Which type of event would typically be captured in an audit log?
Select an answer first
7foundation · easy
Which storage solution is most appropriate for long-term retention of audit logs that must be preserved for several years?
Select an answer first
8application · medium
A security analyst is reviewing authentication logs and notices that a single user account has had 500 failed login attempts over the past hour from a single IP address. Which analysis technique would be most effective to determine whether this is a brute-force attack or a user who forgot their password?
Select an answer first
9foundation · easy
What is the primary purpose of generating regular reports from audit logs?
Select an answer first
10foundation · easy
Which of the following is an example of a policy violation that could be detected through audit log analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.