Which practice is considered a logging best practice?

Allowing all users to read logs to increase transparency

Disabling logging on high-volume systems to save resources

Synchronizing clocks across all systems to ensure accurate timestamps

Storing logs only on the local system where they are generated

Which technique is used to detect tampering of log files?

Copying the log files to a USB drive

Encrypting the log files with a shared password

Compressing the log files to reduce size

Hashing the log files and storing the hashes securely

A healthcare organization must retain authentication logs for two years to meet regulatory requirements, but storage is limited. They also need to quickly access logs from the last 30 days for active investigations. Which storage strategy best balances compliance and operational needs?

Compress logs and store them on the same hot tier for two years to reduce space.

Store logs in a hot tier for 30 days, then move them to a cold archival tier for the remaining retention period.

Delete logs older than 30 days to free storage and rely on backups for compliance.

Keep all logs in the hot tier for the full two years to ensure fastest access at all times.

A security manager must implement a logging solution for a multi-tenant SaaS environment. The compliance team requires that logs from different customers be isolated and retained for 7 years. The operations team wants to minimize storage costs. Which approach best satisfies both requirements?

Delete logs older than 1 year to reduce storage costs.

Store each customer's logs in a separate SIEM instance to ensure physical isolation.

Retain all logs in hot storage for 7 years to ensure fast access.

Use a single log repository with customer ID tags and lifecycle policies that archive logs older than 90 days to cold storage.

Which technique is commonly used to detect anomalies in security logs?

Deleting logs that appear normal

Storing logs in a read-only format

Baselining normal behavior and flagging deviations

GIAC Network Forensic Analyst

Domain 3Objective 2

Security Event and Incident Logging GNFA Practice Questions (Page 6)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
Which practice is considered a logging best practice?
Select an answer first
27foundation · easy
Which technique is used to detect tampering of log files?
Select an answer first
28application · medium
A healthcare organization must retain authentication logs for two years to meet regulatory requirements, but storage is limited. They also need to quickly access logs from the last 30 days for active investigations. Which storage strategy best balances compliance and operational needs?
Select an answer first
29expert · hard
A security manager must implement a logging solution for a multi-tenant SaaS environment. The compliance team requires that logs from different customers be isolated and retained for 7 years. The operations team wants to minimize storage costs. Which approach best satisfies both requirements?
Select an answer first
30foundation · easy
Which technique is commonly used to detect anomalies in security logs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.