A company is planning to centralize logs from multiple remote offices. The network links are low-bandwidth and sometimes unreliable. They need to ensure logs are transmitted securely and without loss. Which approach is most appropriate?

Compress logs before transmission to reduce bandwidth, but do not use encryption.

Use a reliable, encrypted transport protocol such as TLS and implement a local buffer on each remote site.

Send logs via email to the central server to ensure delivery.

Use syslog over UDP to minimize bandwidth and accept occasional loss.

An analyst notices a spike in failed authentication attempts on a VPN gateway, followed by a successful login from the same source IP, and then a large data download from an internal file server. Which type of log correlation would best confirm that this is a single coordinated attack?

Correlating the VPN gateway logs with the file server logs using the source IP and timestamps.

Searching for the source IP in threat intelligence feeds to see if it is known malicious.

Checking the file server logs for the data download and ignoring the VPN logs.

Reviewing only the VPN gateway logs to see the failed attempts and successful login.

A company is implementing a new SIEM and wants to ensure logs are not lost if the SIEM is unavailable. Which practice is most important to implement?

Increase the log retention period on the SIEM to 90 days.

Enable local log buffering on each source so logs are queued and forwarded when the SIEM is reachable.

Configure the SIEM to send alerts to the security team when it is overloaded.

Use a second SIEM in a different region for failover.

An organization is subject to a regulation that requires logs to be retained for 1 year, but a pending lawsuit requires preservation of all logs related to a specific incident. The incident logs are currently scheduled for deletion in 30 days. What is the most appropriate action?

Delete the incident logs on schedule because the regulation only requires 1 year.

Anonymize the incident logs and keep them for 30 days.

Extend the retention period for all logs to 5 years to avoid future legal holds.

Place a legal hold on the incident-related logs, suspending deletion until the lawsuit is resolved.

GIAC Network Forensic Analyst

Domain 3Objective 2

Security Event and Incident Logging GNFA Practice Questions (Page 7)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 31–35

31expert · hard
A company is planning to centralize logs from multiple remote offices. The network links are low-bandwidth and sometimes unreliable. They need to ensure logs are transmitted securely and without loss. Which approach is most appropriate?
Select an answer first
32application · medium
An analyst notices a spike in failed authentication attempts on a VPN gateway, followed by a successful login from the same source IP, and then a large data download from an internal file server. Which type of log correlation would best confirm that this is a single coordinated attack?
Select an answer first
33application · medium
A company is implementing a new SIEM and wants to ensure logs are not lost if the SIEM is unavailable. Which practice is most important to implement?
Select an answer first
34expert · hard
An organization is subject to a regulation that requires logs to be retained for 1 year, but a pending lawsuit requires preservation of all logs related to a specific incident. The incident logs are currently scheduled for deletion in 30 days. What is the most appropriate action?
Select an answer first
35foundation · easy
Which log source would most likely contain records of user authentication attempts on a Windows workstation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.