Security Event and Incident Logging GNFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A legal hold requires an organization to preserve all logs related to a lawsuit for an indefinite period. Which action is most appropriate?

   • AExport the logs to a spreadsheet and store it on a network share.
   • BExtend the log retention period to the maximum allowed by the SIEM.
   • CCopy the logs to a cloud storage bucket with versioning enabled.
   • DPlace the relevant logs on a separate, immutable storage volume and suspend any automated deletion or rotation.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is implementing a new logging policy. They want to ensure that logs are available for incident investigation but also want to minimize the risk of logs being used against them in a legal dispute. Which practice is most appropriate?

   • ARetain logs for the minimum period required by law and delete them promptly after.
   • BStore logs only in memory and do not persist them to avoid legal discovery.
   • CRetain logs for as long as possible to ensure availability for any investigation.
   • DEstablish a retention policy that balances legal requirements, operational needs, and storage costs.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization has multiple remote offices with limited bandwidth. They need to centralize logs but want to minimize WAN usage. Which approach is most effective?

   • AStore logs locally and never forward them to the central repository.
   • BOnly forward logs that match a predefined alert rule.
   • CDeploy a local log collector at each office that aggregates and forwards compressed logs in batches.
   • DForward all logs directly from each device to the central SIEM in real time.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident responder is investigating a possible malware infection on a Windows workstation. Which log source would provide the most direct evidence of the initial execution of the malware?

   • AFile system audit logs showing file creation in the user's temp folder.
   • BWindows Event Log (e.g., Event ID 4688) showing process creation with command line.
   • CDNS logs showing queries to a suspicious domain.
   • DFirewall logs showing outbound connections from the workstation.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is investigating a potential data breach. They have authentication logs, web proxy logs, and database audit logs. The web proxy logs show a user downloading a large file from an internal server, and the database audit logs show a query that returned a large result set. Which correlation would most strongly indicate data exfiltration?

   • AThe same user account appears in both the web proxy and database logs within a short time window.
   • BThe database audit log shows a query that ran at night.
   • CThe authentication log shows a successful login from a known IP.
   • DThe web proxy log shows a download during business hours.
   Reveal Solution Discussion Select an answer first