A security team is implementing a log management solution for a regulated environment. They must ensure that logs are tamper-evident and that the log repository itself is protected from unauthorized access. They also need to retain logs for seven years. Which combination of controls is most appropriate?

Store logs in a cloud-based SIEM with default settings and rely on the provider for security.

Use a write-once, read-many (WORM) storage system for logs but do not implement access controls.

Encrypt logs in transit using TLS and store them on the same server as the hashes.

Use a centralized log server with hashing of each log entry and store the hashes in a separate, access-controlled database.

A financial services company must retain security logs for at least one year to meet regulatory requirements. They currently store logs on a local syslog server with limited disk space. The compliance team wants to ensure logs are available for the full retention period without manual intervention. Which solution best meets the requirement?

Send logs to a network-attached storage (NAS) device with a one-year retention policy configured.

Forward logs to a cloud-based log management service with configurable retention policies and archival storage.

Compress logs daily and store them on the same server to save space, keeping them for one year.

Increase the disk space on the existing syslog server and set log rotation to overwrite old logs after 90 days.

Which method is commonly used to collect logs from multiple servers into a central log management system?

Having the central system remotely read each server's memory

Using a network sniffer to capture all log traffic

Manually copying log files via USB drives

Installing an agent on each server that forwards logs to the central system

What is the purpose of log correlation?

To combine and analyze logs from multiple sources to identify patterns that indicate an incident

To generate a single log entry for each event

To delete duplicate log entries

To compress logs for storage efficiency

During an incident investigation, an analyst discovers that a critical log file has been modified. Which action is most important to preserve evidence?

Change the file permissions to read-only.

Delete the log file to prevent further tampering.

Overwrite the log file with a backup copy.

Immediately create a forensic copy of the log file using a write-blocker or hashing tool.

GIAC Network Forensic Analyst

Domain 3Objective 2

Security Event and Incident Logging GNFA Practice Questions (Page 9)

Part of the Security Controls and Monitoring domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 9–15 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 41–45

41expert · hard
A security team is implementing a log management solution for a regulated environment. They must ensure that logs are tamper-evident and that the log repository itself is protected from unauthorized access. They also need to retain logs for seven years. Which combination of controls is most appropriate?
Select an answer first
42application · medium
A financial services company must retain security logs for at least one year to meet regulatory requirements. They currently store logs on a local syslog server with limited disk space. The compliance team wants to ensure logs are available for the full retention period without manual intervention. Which solution best meets the requirement?
Select an answer first
43foundation · easy
Which method is commonly used to collect logs from multiple servers into a central log management system?
Select an answer first
44foundation · easy
What is the purpose of log correlation?
Select an answer first
45application · medium
During an incident investigation, an analyst discovers that a critical log file has been modified. Which action is most important to preserve evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.