Security Event and Incident Logging GNFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A small company wants to implement security event logging for the first time. They have a mix of Windows and Linux servers, a firewall, and a web application. The IT manager wants a simple solution that provides a central view of all security-relevant events without requiring a dedicated security team. Which approach is most appropriate?

   • AConfigure the web application to log all events to a text file and rely on that for security monitoring.
   • BEnable logging on each device and have the IT administrator manually review logs on each system weekly.
   • CUse a centralized log management tool that collects logs from all devices and provides dashboards and alerts.
   • DStore logs only on the firewall because it sees all network traffic and is the most important source.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a recommended best practice for protecting logs from tampering?

   • ACompressing logs to make them harder to read
   • BForwarding logs to a centralized, write-once storage system
   • CAllowing administrators to edit logs to correct errors
   • DStoring logs in plain text on the local disk
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does incident logging support the incident response process?

   • ABy providing a detailed record of the incident's timeline, actions taken, and evidence collected
   • BBy replacing the need for forensic analysis
   • CBy automatically containing the incident and preventing further damage
   • DBy ensuring that all incidents are reported to law enforcement
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization is investigating a phishing campaign that resulted in a user downloading a malicious attachment. Which combination of log sources would provide the most complete picture of the attack?

   • AFirewall logs and DNS logs only.
   • BApplication logs and operating system logs only.
   • CEmail gateway logs, proxy logs, and endpoint EDR logs.
   • DAuthentication logs and VPN logs only.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is it important to protect logs from unauthorized access?

   • ATo ensure logs are generated in real time
   • BTo make logs easier to read
   • CTo prevent attackers from covering their tracks by modifying or deleting logs
   • DTo reduce the storage space required for logs
   Reveal Solution Discussion Select an answer first