Which of the following is an example of a network device log source?

Cisco ASA firewall syslog messages

Which statement best describes the role of security event logging in incident detection?

It provides the raw data that monitoring and analysis tools use to identify potential security incidents

It automatically blocks malicious activity before it occurs

It eliminates the need for human analysis of security events

It ensures that all security incidents are prevented

What is the primary purpose of security event logging in an organization?

To store all network traffic for legal discovery

To replace the need for real-time monitoring tools

To record all user keystrokes for productivity monitoring

To provide a chronological record of security-relevant activities for monitoring and incident detection

A network forensic analyst is investigating a suspected port scan against a server. Which log source would provide the most direct evidence of the scan?

Firewall logs showing denied inbound connections to multiple ports from a single source IP.

DNS logs showing queries from the server.

Authentication logs showing failed logins.

Application logs from the web server showing HTTP requests.

In the context of incident logging, what constitutes an incident?

Any event that is logged by a security control

Any attempt to access a system that is blocked by a firewall

An event that has been confirmed to violate security policy or compromise the confidentiality, integrity, or availability of an asset

A single failed login attempt on a user account

GIAC Network Forensic Analyst

Domain 3Objective 2

Security Event and Incident Logging GNFA Practice Questions (Page 3)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 11–15

11foundation · easy
Which of the following is an example of a network device log source?
Select an answer first
12foundation · easy
Which statement best describes the role of security event logging in incident detection?
Select an answer first
13foundation · easy
What is the primary purpose of security event logging in an organization?
Select an answer first
14application · medium
A network forensic analyst is investigating a suspected port scan against a server. Which log source would provide the most direct evidence of the scan?
Select an answer first
15foundation · easy
In the context of incident logging, what constitutes an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.