Network Forensics, Logging, and Event Management GCED Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is required to retain logs for two years for compliance. They currently store logs in a SIEM with a one-year retention period. The SIEM is nearing capacity, and extending retention would require significant additional storage investment. The company is considering archiving older logs to a low-cost storage solution. Which of the following is the most important consideration when implementing this archive?

   • AStore archived logs on the same SIEM storage to simplify management.
   • BEnsure the archived logs can be quickly restored and searched when needed for investigations.
   • CDelete logs older than one year to avoid storage costs.
   • DCompress the logs to reduce storage costs, even if it makes them unreadable.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is deploying a SIEM and wants to ensure that alerts are actionable and not overwhelming. Which of the following is the most effective practice to achieve this?

   • ADisable all alerts and rely on manual log review.
   • BEnable all default correlation rules provided by the SIEM vendor.
   • CIncrease the severity threshold for all alerts to reduce volume.
   • DTune correlation rules based on the organization's environment and known false positives.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is investigating a data breach that occurred over a month ago. The security team has firewall logs, but they did not capture full packet data. The legal team is asking for evidence that can be used in court. What is the best course of action?

   • AUse the firewall logs as the primary evidence and document their limitations.
   • BRely on memory of the incident responders to fill in the gaps.
   • CDeclare that the evidence is insufficient and close the investigation.
   • DAttempt to reconstruct the network traffic from the firewall logs.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is reviewing logs from multiple sources during an incident. The firewall logs show a connection from an internal IP to an external IP on port 443. The IDS logs show a signature match for 'malicious SSL traffic' for the same connection. The Windows event logs on the internal host show a process that made an outbound connection to that external IP. Which of the following is the most complete and accurate conclusion?

   • AThe firewall logs are the most reliable and the connection is benign.
   • BThe internal host is definitely compromised and the external IP is a command-and-control server.
   • CThe Windows event logs are irrelevant because they only show local activity.
   • DThe internal host made an outbound connection to the external IP, and the IDS flagged it as potentially malicious, but further investigation is needed.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is investigating a potential brute-force attack. The SIEM shows multiple failed login attempts from a single IP address against the VPN gateway, followed by a successful login from the same IP. However, the analyst also sees that the same IP address has been used for successful logins in the past. What should the analyst do next?

   • ABlock the IP address immediately to prevent further access.
   • BCorrelate the VPN logs with the user's activity after login to look for anomalies.
   • CReset the user's password and require multi-factor authentication.
   • DIgnore the event because the IP is known and has logged in successfully before.
   Reveal Solution Discussion Select an answer first