An analyst is correlating logs to detect a multi-stage attack. They have authentication logs, firewall logs, and endpoint detection logs. Which correlation technique would be most effective?

Only analyze logs from the endpoint detection system.

Use a single log source that contains all relevant events.

Search each log source independently for known indicators of compromise.

Join logs on common fields such as source IP, user, and timestamp to build a timeline of activity.

An analyst notices that a user account has been locked out multiple times over the past hour. The account is a service account used by a legacy application. Which additional log source would be most useful to determine whether this is a security incident or a misconfiguration?

Authentication logs from the domain controller showing the source IP and failure reason.

DNS logs showing queries made by the application server.

Application logs from the legacy application showing its startup and shutdown times.

Firewall logs showing all outbound traffic from the application server.

A security team is designing a log integrity solution. They want to detect any modification of logs, but they also need to allow legitimate log rotation and deletion after retention. Which approach is most appropriate?

Encrypt all logs with a key held by the security team.

Store logs in a database with only INSERT privileges for the logging application.

Use WORM storage for all logs, preventing any deletion or modification.

Use a signed hash chain that includes a timestamp and allows authorized rotation through a separate, audited process.

A company's security team is required to preserve log evidence for a potential legal case. They currently store logs on a central syslog server that is administered by the same team that manages the network devices. The legal team wants assurance that logs cannot be altered or deleted by an attacker who compromises the network devices. Which approach best addresses this concern?

Configure the central log server to accept logs only from specific source IP addresses using firewall rules.

Increase log verbosity on the network devices to capture more detail for the investigation.

Write logs to write-once, read-many (WORM) storage or use a separate, access-controlled log management platform.

Enable syslog over TLS to encrypt log transmissions between devices and the central server.

What is the purpose of archiving logs?

To make logs available for real-time analysis

To delete logs that are no longer needed

To compress logs to reduce their size

To store logs in a cost-effective manner for long-term retention and compliance

GIAC Network Forensic Analyst

Domain 3Objective 2

Security Event and Incident Logging GNFA Practice Questions (Page 2)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 6–10

6application · medium
An analyst is correlating logs to detect a multi-stage attack. They have authentication logs, firewall logs, and endpoint detection logs. Which correlation technique would be most effective?
Select an answer first
7application · medium
An analyst notices that a user account has been locked out multiple times over the past hour. The account is a service account used by a legacy application. Which additional log source would be most useful to determine whether this is a security incident or a misconfiguration?
Select an answer first
8expert · hard
A security team is designing a log integrity solution. They want to detect any modification of logs, but they also need to allow legitimate log rotation and deletion after retention. Which approach is most appropriate?
Select an answer first
9application · medium
A company's security team is required to preserve log evidence for a potential legal case. They currently store logs on a central syslog server that is administered by the same team that manages the network devices. The legal team wants assurance that logs cannot be altered or deleted by an attacker who compromises the network devices. Which approach best addresses this concern?
Select an answer first
10foundation · easy
What is the purpose of archiving logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.