312-39 Log Management Practice Test 2 — 15 Questions

Question 1

Which THREE items are essential components of a robust log management policy?

Accepted Answer

Definition of log retention periods. A robust log management policy must define log retention periods (B) because regulatory, legal, and forensic requirements dictate how long logs must be preserved and when they can be securely purged. It must also specify encryption standards for log transmission (C), such as TLS 1.2/1.3 or syslog over TLS, to protect log integrity and confidentiality against interception or tampering in transit. Additionally, a log source inventory list (D) is essential to ensure comprehensive coverage by identifying every device, application, and system that generates logs, preventing blind spots in monitoring and auditing. In contrast, default login credentials (A) are a security vulnerability and should never be part of a policy, and the salary of a SOC analyst (E) is an HR matter unrelated to log management controls.

Answer

Default login credentials for all devices

Answer

The salary of the SOC analyst

Question 2

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

Accepted Answer

Generating cryptographic hashes for log files. Generating cryptographic hashes for log files creates a tamper-evident seal: any modification to the log changes its hash, which can be detected by recomputing and comparing. This is the most robust method because it provides integrity verification even if an attacker gains write access to the logs. Hashing should be done immediately after log rotation and stored separately from the logs themselves.

Answer

Storing logs on a local partition

Answer

Clearing the logs daily

Answer

Setting file permissions to read-only

Question 3

What is the primary benefit of using a centralized logging server compared to local logging?

Accepted Answer

Simplified log correlation and incident response. A centralized logging server aggregates logs from many sources into one location, enabling correlation of events across hosts, applications, and time zones — which is essential for detecting multi-stage attacks and accelerating incident response. Local logging scatters evidence across individual machines, making cross-system correlation slow or impossible during an investigation. Centralization also supports retention, tamper resistance, and compliance reporting from a single platform.

Answer

Increased disk space on the local server

Answer

Eliminating the need for a security policy

Answer

Faster network traffic speeds

Question 4

Which TWO log types are considered critical for forensic analysis after a network intrusion?

Accepted Answer

Firewall traffic logs. Firewall traffic logs (C) are critical because they record allowed and denied connections with source/destination IP addresses, ports, and timestamps, letting investigators reconstruct how an attacker entered, which hosts were targeted, and whether data exfiltration occurred. VPN authentication logs (E) are equally critical since they capture remote-access events such as usernames, source IPs, authentication successes/failures, and session durations, which can reveal compromised credentials or unauthorized remote sessions used during the intrusion. The remaining options are not forensic-relevant to a network intrusion: office wallpaper settings (A) and mouse driver version logs (D) are cosmetic or endpoint configuration data with no network activity, and printer status logs (B) only reflect print job and device health information, none of which establish attacker traffic or access.

Answer

Office wallpaper settings

Answer

Printer status logs

Answer

Mouse driver version logs

Question 5

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Accepted Answer

Extracting fields using Regex during the ingestion pipeline. Option D is correct because SIEM ingestion pipelines commonly use regular expressions (Regex) to parse raw, heterogeneous log lines and extract fields (timestamps, source IPs, usernames, event IDs) into a consistent structure during ingestion. Option E is correct because applying a standardized schema such as Common Event Format (CEF) or Elastic Common Schema (ECS) maps vendor-specific fields to a uniform naming and typing convention, which is the essence of log normalization. The unmarked options do not belong: deleting incoming log metadata (A) destroys context rather than normalizing it, increasing network MTU size (B) is a Layer 3/4 network tuning change unrelated to log parsing, and running a brute-force attack on a log file (C) is neither a normalization technique nor a legitimate SIEM practice.

Answer

Deleting all incoming log metadata

Answer

Increasing the network MTU size

Answer

Running a brute-force attack on the log file

Question 6

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Accepted Answer

Regulatory compliance requirements (e.g., GDPR, HIPAA). Option A is correct because regulatory frameworks such as GDPR, HIPAA, PCI DSS, and SOX impose explicit minimum retention periods for audit and security logs, so the SOC must retain logs at least as long as the strictest applicable mandate requires. Option B is correct because log retention is bounded by available storage capacity; the volume of logs generated per day, combined with the retention window, determines the storage and archiving infrastructure needed, and insufficient capacity forces trade-offs such as shorter retention or tiered storage. Option C is correct because the average time to detect an incident (dwell time) defines how far back investigators must be able to look to reconstruct an intrusion; if logs are purged before the typical detection window, the SOC loses the evidence needed for detection, triage, and root-cause analysis. Option D is not relevant because the physical color of hardware chassis has no bearing on log retention policy or security requirements. Option E is not relevant because the scheduled time of day for backups affects backup operations, not the duration for which logs must be retained.

Answer

The color of the hardware chassis

Answer

The time of day the backup is scheduled

Question 7

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

Accepted Answer

Managing high volumes of 'noise' logs that lack security value. Option B is correct because centralized log management in a large enterprise ingests telemetry from many sources, and a large proportion of those events are low-value or duplicate 'noise' logs (e.g., routine debug, verbose application chatter) that must be filtered, tuned, or dropped to keep the SIEM useful. Option C is correct because shipping raw log streams from hundreds or thousands of hosts, appliances, and cloud services to a central collector consumes significant network bandwidth, and without compression, batching, or filtering this can saturate WAN or inter-DC links. Option D is correct because the aggregator/indexer tier (e.g., syslog relays, Kafka brokers, Elasticsearch clusters) must be sized and horizontally scaled to absorb peak ingestion rates and query loads, which is a well-known operational challenge. Option A is not a challenge of centralized log management; log centralization is about collection, correlation, and retention, not headcount reduction. Option E is unrelated, since log management concerns logical data storage and network capacity, not the physical dimensions of office space.

Answer

Reducing the number of employees in the IT department

Answer

Increasing the physical size of the office building

Question 8

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

Accepted Answer

Sysmon Event ID 3 (Network connection). Sysmon Event ID 3 is specifically designed to log network connections along with the initiating process information. This makes it the most suitable log source for correlating outbound connections with processes during a data exfiltration investigation. Other logs either lack network connection details or do not associate connections with processes.

Answer

Windows Security event log

Answer

Windows Application event log

Answer

Windows PowerShell operational log

Question 9

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

Accepted Answer

use-dns(yes);. To replace IP addresses with hostnames in syslog-ng, the use-dns(yes) option must be enabled. This triggers reverse DNS lookups on incoming messages, resolving IPs to hostnames when the sending device does not provide one. The other options either preserve existing hostnames, cache lookups, or handle relay chains, but none enable the necessary DNS resolution.

Answer

keep-hostname(yes);

Answer

dns-cache(yes);

Answer

chain-hostnames(yes);

Question 10

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

Accepted Answer

Logon Type 2. Interactive brute-force attacks against workstations generate Windows Security Event ID 4625 with Logon Type 2, which indicates a user attempted to log on at the physical console. Other logon types correspond to different access methods: Type 3 for network, Type 4 for batch, Type 5 for service, and Type 10 for RDP. Focusing on Type 2 allows the analyst to isolate local interactive password-guessing attempts.

Answer

Logon Type 5

Answer

Logon Type 4

Answer

Logon Type 10

Question 11

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

Accepted Answer

Use log deduplication and correlation rules in the SIEM to group repeated SSH failures from the same source into a single alert with a count.. Deduplication and correlation in the SIEM reduce alert volume by grouping repeated events while retaining the original logs for forensic analysis. This approach maintains visibility into attack patterns such as brute-force attempts without overwhelming the ingestion pipeline. It balances operational efficiency with the need for detailed security context, unlike dropping or limiting logs.

Answer

Configure a filter in the SIEM to drop all SSH failure logs from the authentication server.

Answer

Implement log aggregation with rate limiting on the syslog server to cap the number of SSH failure messages per second.

Answer

Disable SSH logging on the authentication server and rely solely on network flow data for anomaly detection.

Question 12

A SOC is designing a log management pipeline to ingest Windows Event Logs, Syslog from network devices, and application logs into a SIEM. The team needs to ensure that timestamps are consistent across all sources for accurate correlation. Which TWO practices are most effective for achieving time synchronization and accurate event ordering? (Choose two.)

Accepted Answer

Configure all log sources to use NTP with authenticated time sources to maintain accurate clocks.. Accurate time synchronization and normalization are essential for correlating events across heterogeneous log sources. NTP with authentication ensures clocks are aligned, while normalizing to UTC provides a consistent reference. Together, they enable the SIEM to order events correctly and correlate activity across Windows, syslog, and application logs, which is critical for incident detection and forensic analysis.

Answer

Configure log sources to send logs only when their clocks are within 1 second of the SIEM's clock.

Answer

Use the SIEM's internal ingestion timestamp as the primary event time for all logs.

Answer

Enable high-precision timestamps with nanosecond granularity on all log sources.

Question 13

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to examine logs from a Cisco ASA firewall to identify outbound connections that may have transferred sensitive data. Which syslog severity level should the analyst configure on the ASA to capture connection-related events while minimizing log volume?

Accepted Answer

Severity level 6 (Informational). Cisco ASA syslog severity level 6 (Informational) includes connection-related messages such as built and teardown events, which are vital for tracking outbound connections during a data exfiltration investigation. Higher levels like 7 add excessive debugging noise, while lower levels like 4 or 3 omit these informational events. Therefore, level 6 provides the necessary balance of detail and volume.

Answer

Severity level 4 (Warnings)

Answer

Severity level 7 (Debugging)

Answer

Severity level 3 (Errors)

Question 14

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)

Accepted Answer

Web proxy logs. Firewall logs and web proxy logs are the most critical for determining data exfiltration method and volume. Firewall logs show outbound connections and byte counts, while proxy logs provide application-layer details like URLs and payload sizes. Together, they allow the analyst to identify the channel and quantify the data transferred. Other logs like DNS or authentication may provide context but lack the direct volume and method information.

Answer

DNS query logs

Answer

System performance logs

Answer

Authentication logs

Question 15

A SOC analyst is reviewing logs from a web server and notices that the logs contain entries with timestamps in the format '2025-04-01T14:23:45+02:00'. The SIEM is configured to display all events in UTC. What is the correct UTC time for this log entry?

Accepted Answer

2025-04-01 12:23:45 UTC. The log entry has a +02:00 offset, indicating the local time is two hours ahead of UTC. To convert to UTC, subtract two hours, resulting in 12:23:45 UTC. This normalization is essential for the SIEM to correctly order and correlate events from multiple sources with different time zones.

Answer

2025-04-01 16:23:45 UTC

Answer

2025-04-01 14:23:45 UTC

Answer

2025-04-01 14:23:45 local time, no conversion needed