Network Forensics, Logging, and Event Management GCED Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which component of a SIEM is responsible for collecting logs from various sources?

   • AData collector or forwarder
   • BIncident response playbook
   • CAlert dashboard
   • DCorrelation engine
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which scenario best illustrates event correlation?

   • AA server logs a successful user login at 9:00 AM
   • BA SIEM correlates a brute-force attack on a VPN with a subsequent internal scan from the same source IP
   • CAn IDS alert for a known exploit is triggered on a web server
   • DA firewall log shows a blocked inbound connection from an external IP
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action is essential when collecting network forensic evidence to maintain chain of custody?

   • AImmediately analyzing the evidence on the original system
   • BDocumenting the date, time, and identity of the person who collected the evidence
   • CSharing the evidence with all team members for review
   • DStoring the evidence in a publicly accessible location for transparency
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is designing a log management strategy. They need to ensure that logs are available for incident investigation even if the original source system is compromised or destroyed. Which of the following is the most important control to implement?

   • ACompress logs and store them on the same system to save space.
   • BPrint logs to paper and store them in a secure location.
   • CSend logs in real-time to a centralized, remote log server with restricted access.
   • DStore logs locally on each system with write-protection enabled.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An incident responder needs to capture network traffic on a high-traffic production server. The server has limited disk space, and the capture must not interfere with performance. The responder needs to capture traffic for a specific IP address and save it for later analysis. Which approach best balances performance and storage?

   • AUse tcpdump with a BPF filter to capture only traffic to/from the specific IP.
   • BUse Wireshark to capture traffic interactively.
   • CCapture all traffic to a file and filter later.
   • DCapture only packet headers to save space.
   Reveal Solution Discussion Select an answer first