A security analyst is reviewing logs and notices that a user account has been locked out multiple times over the past hour. The lockouts are followed by successful logins from different IP addresses. The user denies any unusual activity. Which analysis would best determine if this is a brute-force attack or a user error?

Correlate the lockout events with the successful login IP addresses and timestamps to see if the successful logins come from the user's typical locations and devices.

Look at the user's login history for the past month to see if they have a pattern of lockouts.

Disable the user account immediately to prevent further access.

Check if the user's password is weak and force a password change.

A security administrator is configuring a central log repository and wants to ensure that logs cannot be altered or deleted by an attacker who compromises the logging server. Which control is the most effective for this purpose?

Encrypt the log files at rest and require a strong password for the log management console.

Send logs to a SIEM and configure alerts for any log deletion events.

Configure the log repository to use WORM storage or an append-only data store, and separate the log ingestion and log administration roles.

Store logs on a network-attached storage (NAS) device and rely on NTFS permissions to restrict access.

A company has 200 Windows servers, 50 Linux servers, and 20 network firewalls. The security team wants to centralize audit logs for real-time alerting and forensic investigation. Which approach is the most practical and scalable for collecting logs from all these sources?

Install a different log collection agent on each type of device and have each agent send logs to a separate vendor-specific console.

Deploy a centralized log management platform and configure each server and firewall to forward logs to it using standard protocols such as Syslog or Windows Event Forwarding.

Enable logging on each device but keep logs locally, and only access them remotely when an incident occurs.

Have the security team manually download logs from each device on a weekly basis and store them in a shared folder.

What is the primary purpose of implementing cryptographic hashing on audit logs?

To detect unauthorized modifications to the logs

To encrypt the logs so they cannot be read

To speed up log analysis queries

To compress the logs to save storage space

GIAC Critical Controls Certification

Domain 5Objective 1

Audit Log Management GCCC Practice Questions (Page 5)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21foundation · easy
Which method is commonly used to collect audit logs from distributed sources into a central repository?
Select an answer first
22expert · hard
A security analyst is reviewing logs and notices that a user account has been locked out multiple times over the past hour. The lockouts are followed by successful logins from different IP addresses. The user denies any unusual activity. Which analysis would best determine if this is a brute-force attack or a user error?
Select an answer first
23application · medium
A security administrator is configuring a central log repository and wants to ensure that logs cannot be altered or deleted by an attacker who compromises the logging server. Which control is the most effective for this purpose?
Select an answer first
24application · medium
A company has 200 Windows servers, 50 Linux servers, and 20 network firewalls. The security team wants to centralize audit logs for real-time alerting and forensic investigation. Which approach is the most practical and scalable for collecting logs from all these sources?
Select an answer first
25foundation · easy
What is the primary purpose of implementing cryptographic hashing on audit logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Audit Log Management GCCC Practice Questions (Page 5)

Questions 21–25

Which method is commonly used to collect audit logs from distributed sources into a central repository?

A security administrator is configuring a central log repository and wants to ensure that logs cannot be altered or deleted by an attacker who compromises the logging server. Which control is the most effective for this purpose?

A company has 200 Windows servers, 50 Linux servers, and 20 network firewalls. The security team wants to centralize audit logs for real-time alerting and forensic investigation. Which approach is the most practical and scalable for collecting logs from all these sources?

What is the primary purpose of implementing cryptographic hashing on audit logs?

Keep studying — Security Operations and Monitoring