You are troubleshooting a performance bottleneck in an ELK Stack deployment. Logstash is dropping events due to backpressure. Which configuration parameter in the Logstash pipeline file is best suited to manage the queue size and prevent memory overflow?
You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?
A SOC uses a Syslog server to collect events from 200 Linux servers. An analyst notices that logs from a compromised server were altered after an incident. The SOC wants to ensure that future logs can be verified as unaltered from the moment they are generated. Which mechanism should be implemented on the Linux servers to provide cryptographic integrity for log entries?
A SOC analyst is reviewing logs from a Windows Server 2019 domain controller to detect credential dumping attempts. The analyst wants to identify events that indicate the use of Mimikatz or similar tools. Which TWO Windows event IDs should the analyst prioritize for detecting credential dumping? (Choose two.)
A security analyst is configuring Windows Event Log forwarding to a central SIEM using Windows Event Forwarding (WEF). The analyst needs to ensure that the forwarded events include the original computer name and the user account associated with each event. Which Windows Event Collector subscription configuration should be used to achieve this?
A SOC analyst is configuring a Linux server to collect logs from various applications. The analyst wants to ensure that logs are stored in a structured format for easier parsing by the SIEM. Which TWO methods can the analyst use to achieve structured logging from applications that do not natively support it? (Choose two.)
A SOC analyst is deploying a new Windows Server 2022 file server and must ensure that all failed logon attempts, account lockouts, and privilege-use events are written to the Windows Security event log so they can be forwarded to the SIEM. Which action should the analyst take to guarantee these events are generated?
When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?
An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?
A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?
You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?
You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?
A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?
A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?
A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?
A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?
A SOC is designing a log management pipeline to ingest Windows Event Logs, Syslog from network devices, and application logs into a SIEM. The team needs to ensure that timestamps are consistent across all sources for accurate correlation. Which TWO practices are most effective for achieving time synchronization and accurate event ordering? (Choose two.)
A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to examine logs from a Cisco ASA firewall to identify outbound connections that may have transferred sensitive data. Which syslog severity level should the analyst configure on the ASA to capture connection-related events while minimizing log volume?
A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)
A SOC analyst is reviewing logs from a web server and notices that the logs contain entries with timestamps in the format '2025-04-01T14:23:45+02:00'. The SIEM is configured to display all events in UTC. What is the correct UTC time for this log entry?
A SOC team is deploying a new log management system and needs to ingest logs from various sources, including Windows Event Logs, Linux syslog, and network device logs. The team wants to ensure that all logs are parsed into a common format for easier analysis. Which component of the ELK Stack is primarily responsible for parsing and transforming logs before they are stored in Elasticsearch?
A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound transfer from an internal server to an external IP, but the firewall logs indicate the connection was allowed. The analyst needs to determine if the transfer was authorized by reviewing application logs. Which log source should the analyst prioritize to identify the user or process that initiated the transfer?
A SOC analyst is reviewing logs from a Linux server and notices that the /var/log/messages file is growing rapidly and consuming disk space. The analyst needs to ensure that logs are rotated daily and compressed, and that only the last 7 days of logs are retained. Which logrotate configuration directive should be used to achieve the retention requirement?
A SOC manager is evaluating the log retention strategy for a new SIEM deployment. Regulatory requirements mandate that all authentication logs be retained for at least one year and be available for immediate search. Which storage tier strategy best meets both the retention and accessibility requirements while optimizing cost?
A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?
A SOC analyst is reviewing logs from a web server and notices repeated requests with URLs containing encoded characters like %27 and %20. The analyst suspects a SQL injection attempt. Which log source should the analyst examine to correlate the source IP and the full request, including headers?
A SOC analyst must configure a Linux web server to forward its logs to a central syslog server over the network. The organization requires reliable delivery and wants to avoid losing messages if the central server is temporarily unreachable. Which TWO syslog configuration directives should the analyst use? (Choose two.)
A SOC analyst is reviewing Apache access logs and needs to extract only the client IP addresses and requested URLs for a threat-hunting query. The log format is the default combined format. Which approach should the analyst use to reliably parse these fields?
A SOC analyst is configuring an ELK Stack to ingest logs from multiple sources. The analyst notices that events from different time zones are being indexed with incorrect timestamps in Elasticsearch. Which action should the analyst take to ensure events are stored with a consistent, correct time reference?