Audit Log Management GCCC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of an audit log in a security monitoring context?

   • ATo automatically block malicious traffic before it reaches the network
   • BTo provide real-time alerts for every user action without any analysis
   • CTo store configuration settings for all network devices in a central location
   • DTo provide a chronological record of events and actions that can be used for security analysis and accountability
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst notices that a critical server's audit logs show a gap of 20 minutes during a suspected intrusion. The logs are stored on the server's local disk and also forwarded to a central SIEM. The analyst suspects the attacker deleted local logs. Which control would most effectively detect and prevent this type of tampering?

   • AUse a log management tool that compresses logs daily and stores them in a password-protected ZIP file on the same server.
   • BConfigure the server to send logs to a remote syslog server on a separate network segment with write-only access for the server.
   • CStore logs on the local disk with NTFS permissions set to allow only the SYSTEM account to write.
   • DEnable local audit policy to log all file access and use Windows Event Forwarding to a domain controller.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company's compliance team requires that audit logs be reviewed within 24 hours of a security event. The security team is small and receives thousands of alerts daily from the SIEM. They are considering implementing a 24/7 security operations center (SOC) but have budget constraints. Which approach best meets the review requirement while managing costs?

   • AConfigure the SIEM to automatically suppress all low-priority alerts so analysts only see critical alerts.
   • BImplement a SIEM with automated alert triage and escalation, and have on-call analysts review high-priority alerts within 24 hours, with a daily summary report for lower-priority events.
   • CHire a 24/7 SOC team to manually review every alert in real time.
   • DReview logs only once a week because the compliance requirement is not enforced.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team is implementing a log management solution and wants to ensure that logs are not tampered with during transmission from the source devices to the central collector. Which control is the most appropriate?

   • AUse TLS-encrypted transport for log forwarding, such as Syslog over TLS or Windows Event Forwarding over HTTPS.
   • BSend logs to the central collector only during off-peak hours to avoid network congestion.
   • CCompress logs before sending them to reduce bandwidth usage.
   • DUse a dedicated VLAN for log traffic and restrict access to the VLAN.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security team is configuring audit logging on a new web application server. The team wants to ensure that the logs are useful for detecting a SQL injection attack. Which type of event should the application be configured to log?

   • AOnly the number of requests per minute, without any request details.
   • BAll database queries that include user-supplied input, along with the source IP address and the authenticated user.
   • COnly server-level errors, such as 500 Internal Server Error responses.
   • DOnly successful login events and password changes.
   Reveal Solution Discussion Select an answer first