A system administrator is configuring audit logging on a new web server that hosts a customer-facing application. The server is behind a load balancer that terminates TLS. Which events should be logged to support security monitoring without violating privacy regulations?

Log authentication attempts, access to sensitive resources, and administrative actions, but avoid logging full request bodies or personal data.

Log the full URL of every request, including query parameters, because that is the only way to detect attacks.

Log all traffic at the load balancer level, including decrypted payloads, to get a complete picture.

Log only successful logins and logouts, because failed attempts are not useful.

Why is it important to have a regular schedule for reviewing audit logs?

To eliminate the need for automated alerting

To ensure that logs are deleted after a certain period

To reduce the amount of storage space used by logs

To ensure that security incidents are detected in a timely manner

A security analyst is investigating a suspected data exfiltration. The analyst has firewall logs showing large outbound transfers from a specific workstation. Which additional log source would be most useful to confirm the data was actually sent from that workstation?

The firewall's configuration backup logs, which show rule changes.

The workstation's operating system audit logs, which record process creation and file access events.

The email server's message tracking logs, which show emails sent by the workstation's user.

The router's interface statistics, which show total bytes sent and received.

A security team is designing a log integrity verification system. They want to detect any modification or deletion of logs in the central repository. Which approach provides the strongest detection capability?

Use file permissions to make log files read-only for all users except the system account.

Generate a cryptographic hash of each log file at collection time and periodically recompute and compare the hashes, storing the original hashes in a separate tamper-evident system.

Encrypt the log files with a key stored on the same server.

Store logs in a database with a trigger that logs any changes to the audit table.

A security analyst is investigating a possible malware infection on a workstation. The analyst has network logs showing the workstation communicated with a known malicious IP address. Which additional log source would best help determine whether the malware executed on the workstation?

The DNS server's query logs, which show the workstation resolved the malicious domain.

The workstation's login logs, which show when the user logged on.

The workstation's process creation logs, which show the executable that initiated the network connection.

The firewall's rule change logs, which show recent modifications to firewall policies.

GIAC Critical Controls Certification

Domain 5Objective 1

Audit Log Management GCCC Practice Questions (Page 3)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11application · medium
A system administrator is configuring audit logging on a new web server that hosts a customer-facing application. The server is behind a load balancer that terminates TLS. Which events should be logged to support security monitoring without violating privacy regulations?
Select an answer first
12foundation · easy
Why is it important to have a regular schedule for reviewing audit logs?
Select an answer first
13application · medium
A security analyst is investigating a suspected data exfiltration. The analyst has firewall logs showing large outbound transfers from a specific workstation. Which additional log source would be most useful to confirm the data was actually sent from that workstation?
Select an answer first
14expert · hard
A security team is designing a log integrity verification system. They want to detect any modification or deletion of logs in the central repository. Which approach provides the strongest detection capability?
Select an answer first
15expert · hard
A security analyst is investigating a possible malware infection on a workstation. The analyst has network logs showing the workstation communicated with a known malicious IP address. Which additional log source would best help determine whether the malware executed on the workstation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.