Network Forensics, Logging, and Event Management GCED Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company has experienced a data breach. The security team has access to firewall logs, IDS alerts, and a pcap of the relevant traffic. The firewall logs show a large outbound transfer to an external IP. The IDS alerts show a signature match for 'data exfiltration' on the same connection. The pcap shows the data was encrypted. The company's legal team wants to know if the data was actually exfiltrated. Which of the following is the most appropriate conclusion?

   • AThe data was definitely exfiltrated because the IDS signature matched.
   • BThe data was not exfiltrated because it was encrypted.
   • CThe data may have been exfiltrated, but the encrypted payload prevents definitive confirmation without additional evidence.
   • DThe firewall logs are sufficient to confirm exfiltration.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is centralized logging important for an organization's security posture?

   • AIt eliminates the need for any other security controls
   • BIt reduces the amount of storage needed for logs
   • CIt provides a single location to search and correlate logs from multiple systems for incident detection
   • DIt automatically blocks malicious IP addresses
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic investigator is preparing to analyze a network capture that will be used in legal proceedings. Which of the following is the most important action to ensure the evidence is admissible?

   • ADocument every step taken during the capture and analysis, including who had access to the evidence.
   • BMake the capture file publicly available for peer review.
   • CDelete the original capture after analysis to protect privacy.
   • DUse the latest version of Wireshark to analyze the capture.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary function of a SIEM system?

   • ATo encrypt all network traffic within an organization
   • BTo replace the need for firewalls and intrusion detection systems
   • CTo aggregate and analyze log data from multiple sources to provide real-time monitoring and alerting
   • DTo automatically patch vulnerabilities in operating systems
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is deploying a SIEM and needs to ensure that logs are not tampered with. They are considering using a separate logging server that only accepts logs via a secure protocol. Which approach best ensures log integrity?

   • AUse syslog over UDP to send logs to the logging server.
   • BUse syslog over TLS to send logs to the logging server.
   • CStore logs locally on each device and copy them periodically.
   • DUse a shared network drive to store logs.
   Reveal Solution Discussion Select an answer first