During an incident response, an analyst needs to determine whether a specific user account was used to access a sensitive file server. Which log source would provide the most direct evidence?

File server audit logs that record successful and failed access attempts by user account.

Authentication logs that show successful logins to the domain.

Firewall logs that show connections to the file server's IP address.

DNS logs that show queries for the file server's hostname.

A security team is designing a logging strategy for a new application. They want to ensure that logs are useful for incident detection without overwhelming the storage system. Which practice is most effective?

Disable logging for routine events to reduce noise and save storage.

Store logs only for 30 days to minimize storage costs.

Log security-relevant events and set appropriate log levels based on the event's importance.

Log all events at the highest verbosity level to ensure no detail is missed.

A company is deploying a SIEM to aggregate logs from multiple sources. They have a mix of on-premises and cloud-based systems. The compliance team requires that logs be stored in a specific geographic region. Which deployment model is most appropriate?

Deploy the SIEM on-premises and have cloud sources send logs to it over the internet.

Use two separate SIEMs, one for on-premises and one for cloud, and do not aggregate them.

Use a cloud SIEM in a different region and rely on encryption to protect the data.

Deploy the SIEM in the cloud in the required region and configure all sources to send logs to it.

During an incident, the security team needs to determine the scope of a compromise. They have logs from the firewall, Active Directory, and endpoint detection. Which approach is most effective for scoping?

Use Active Directory logs alone to find privileged account changes.

Correlate authentication events with endpoint detection alerts to identify all compromised accounts and hosts.

Review only firewall logs to identify external IPs.

Review only endpoint detection alerts for malware.

A global company needs to collect logs from thousands of devices across multiple regions. They must ensure log integrity and be able to detect tampering. They also want to minimize the chance of a single point of failure. Which architecture is most appropriate?

Deploy regional log collectors that forward to a central SIEM with a cryptographic hash chain for integrity.

Use a peer-to-peer log sharing network without a central repository.

Have every device send logs directly to a single central SIEM.

Store logs only on each device and periodically hash them.

GIAC Network Forensic Analyst

Domain 3Objective 2

Security Event and Incident Logging GNFA Practice Questions (Page 5)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 21–25

21application · medium
During an incident response, an analyst needs to determine whether a specific user account was used to access a sensitive file server. Which log source would provide the most direct evidence?
Select an answer first
22application · medium
A security team is designing a logging strategy for a new application. They want to ensure that logs are useful for incident detection without overwhelming the storage system. Which practice is most effective?
Select an answer first
23expert · hard
A company is deploying a SIEM to aggregate logs from multiple sources. They have a mix of on-premises and cloud-based systems. The compliance team requires that logs be stored in a specific geographic region. Which deployment model is most appropriate?
Select an answer first
24expert · hard
During an incident, the security team needs to determine the scope of a compromise. They have logs from the firewall, Active Directory, and endpoint detection. Which approach is most effective for scoping?
Select an answer first
25expert · hard
A global company needs to collect logs from thousands of devices across multiple regions. They must ensure log integrity and be able to detect tampering. They also want to minimize the chance of a single point of failure. Which architecture is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.