312-39 Log Management — Timed 25 Questions

Question 1

You are troubleshooting a performance bottleneck in an ELK Stack deployment. Logstash is dropping events due to backpressure. Which configuration parameter in the Logstash pipeline file is best suited to manage the queue size and prevent memory overflow?

25 minute time limit — choose an answer to begin.

Accepted Answer

Increase the pipeline.batch.size. pipeline.batch.size and pipeline.workers are key, but pipeline.ordered controls the processing flow and buffer behavior directly.

Answer

Set the log.level to error

Answer

Disable the Elasticsearch output plugin

Answer

Change the time_zone parameter

Question 2

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

Accepted Answer

wecutil es. The `wecutil es` command enumerates all active Windows Event Forwarding (WEF) subscriptions on the local machine, showing subscription names, IDs, and status. It is the correct tool for verifying whether a WEF subscription is active and healthy on a collector or source computer. This directly answers the question about checking subscription status.

Answer

wmic eventlog

Answer

winrm get config

Answer

gpresult /r

Question 3

A SOC uses a Syslog server to collect events from 200 Linux servers. An analyst notices that logs from a compromised server were altered after an incident. The SOC wants to ensure that future logs can be verified as unaltered from the moment they are generated. Which mechanism should be implemented on the Linux servers to provide cryptographic integrity for log entries?

Accepted Answer

Use the systemd-journald Forward Secure Sealing (FSS) feature to seal journal entries with a key.. Forward Secure Sealing (FSS) in systemd-journald cryptographically seals journal entries at creation and allows later verification that they have not been altered. This meets the requirement for integrity from the moment logs are generated. Other options either protect only in transit (TLS), provide auditing without cryptographic integrity, or apply encryption only after rotation, leaving a window for tampering.

Answer

Enable the auditd service to generate audit records for all system calls and forward them to the SIEM.

Answer

Configure logrotate to compress and encrypt log files with GnuPG after rotation.

Answer

Configure Rsyslog to sign each log message using a private key and include the signature in the message.

Question 4

A SOC analyst is reviewing logs from a Windows Server 2019 domain controller to detect credential dumping attempts. The analyst wants to identify events that indicate the use of Mimikatz or similar tools. Which TWO Windows event IDs should the analyst prioritize for detecting credential dumping? (Choose two.)

Accepted Answer

Event ID 10 from Sysmon (ProcessAccess). Sysmon Event ID 10 (ProcessAccess) is specifically designed to capture process memory access, which is a hallmark of credential dumping tools targeting LSASS. Event ID 4688 (Process Creation) can reveal the execution of credential dumping tools via command-line arguments. Together, they provide strong detection capabilities for Mimikatz-like activity. Other events, while useful for general auditing, are not as directly indicative of credential dumping.

Answer

Event ID 4656 (A handle to an object was requested)

Answer

Event ID 4663 (An attempt was made to access an object)

Answer

Event ID 4624 (An account was successfully logged on)

Question 5

A security analyst is configuring Windows Event Log forwarding to a central SIEM using Windows Event Forwarding (WEF). The analyst needs to ensure that the forwarded events include the original computer name and the user account associated with each event. Which Windows Event Collector subscription configuration should be used to achieve this?

Accepted Answer

Use the 'Default' delivery mode and ensure the subscription's query includes the desired events.. Windows Event Forwarding using the default (Normal) delivery mode preserves the original event data, including computer name and user account, provided the source event contains them. The subscription query should be configured to collect events that include these details. Other delivery modes like Minimize Bandwidth may alter data, but do not remove fields. There is no specific option to include computer name; it is inherent.

Answer

Set the subscription to use the 'Minimize Bandwidth' delivery mode.

Answer

Configure the subscription to use the 'Normal' delivery mode and ensure the event log is set to include the user account.

Answer

Enable the 'Include the computer name in the event' option in the subscription properties.

Question 6

A SOC analyst is configuring a Linux server to collect logs from various applications. The analyst wants to ensure that logs are stored in a structured format for easier parsing by the SIEM. Which TWO methods can the analyst use to achieve structured logging from applications that do not natively support it? (Choose two.)

Accepted Answer

Use a log shipper like Filebeat with a custom Grok pattern to parse unstructured logs into JSON fields.. Filebeat with Grok patterns and rsyslog with JSON templates both allow transformation of unstructured application logs into structured formats like JSON at the collection layer. Filebeat processes logs before forwarding, while rsyslog can format messages using templates. These methods enable SIEMs to parse and index fields efficiently. The other options either increase volume without structure, introduce batch delays, or defer parsing to search time, which is less efficient.

Answer

Store logs in a flat file and use a cron job to periodically convert them to CSV.

Answer

Enable debug-level logging in the application to generate more detailed messages.

Answer

Use a regular expression in the SIEM to extract fields at search time.

Question 7

A SOC analyst is deploying a new Windows Server 2022 file server and must ensure that all failed logon attempts, account lockouts, and privilege-use events are written to the Windows Security event log so they can be forwarded to the SIEM. Which action should the analyst take to guarantee these events are generated?

Accepted Answer

Enable the "Audit Logon" and "Audit Account Management" policies under Advanced Audit Policy Configuration in the Default Domain Policy.. Granular audit subcategories under Advanced Audit Policy Configuration control whether Windows generates specific Security events such as failed logons (4625), account lockouts (4740), and special privilege use (4672). Configuring these subcategories through a domain GPO ensures consistent, enforceable auditing across servers, which is a prerequisite for reliable SIEM ingestion and detection.

Answer

Run auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable and auditpol /set /category:"Account Management" /success:enable /failure:enable on the server.

Answer

Increase the maximum size of the Security event log to 1 GB and set it to overwrite events as needed.

Answer

Install the Windows SIEM agent and configure it to read from the C:\Windows\System32\winevt\Logs folder.

Question 8

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

Accepted Answer

Keep logs for one year, with 3 months immediately available. PCI-DSS requirement 10.7 mandates retaining audit logs for at least one year, with a minimum of three months immediately available for analysis. This ensures that logs are accessible for forensic investigations and compliance audits, while older logs can be archived but must be retrievable.

Answer

Archive all logs in a local text file format only

Answer

Retain logs for exactly 30 days

Answer

Delete logs after they are indexed in the SIEM

Question 9

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

Accepted Answer

TCP. TCP is the preferred protocol for centralized log transmission because it is connection-oriented and provides acknowledgements (ACKs) for every segment delivered, guaranteeing that logs arrive at the aggregator intact and in order. This delivery confirmation is essential for compliance and forensic integrity, where lost log entries can create dangerous blind spots. UDP offers no such guarantee, making it unsuitable when reliable delivery is a requirement.

Answer

UDP

Answer

ICMP

Answer

ARP

Question 10

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

Accepted Answer

CloudWatch Unified Agent. The CloudWatch Unified Agent (formerly the unified CloudWatch agent) is the AWS-supported agent that runs on on-premises servers and can collect and forward logs (and metrics) to CloudWatch Logs over the public AWS endpoints. It supports both the logs and metrics plugins in a single agent, making it the correct choice for streaming on-premises logs into CloudWatch. The other options are AWS services, not agents installed on a server.

Answer

Simple Queue Service (SQS)

Answer

Kinesis Firehose

Answer

AWS Config

Question 11

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

Accepted Answer

Implementing TLS-based log forwarding. TLS-based log forwarding encrypts log data in transit, ensuring confidentiality and integrity. It uses certificates for authentication and encryption, protecting against eavesdropping and tampering. This is the most secure method among the options.

Answer

Utilizing SNMPv1 traps

Answer

Encapsulating logs in cleartext UDP packets

Answer

Using standard port 514 without encryption

Question 12

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

Accepted Answer

Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/. syslog-ng destination paths support template macros such as $HOST, $YEAR, $MONTH, $DAY, and $PROGRAM, which are expanded at runtime for each message. Using /var/log/$HOST/$YEAR/$MONTH/ dynamically creates per-host directories, satisfying the requirement to separate logs by hostname without manual configuration.

Answer

Defining separate log paths for every individual IP address

Answer

Configuring the global log_level to debug

Answer

Using hardcoded static path strings only

Question 13

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Accepted Answer

/etc/logrotate.conf. The logrotate utility reads its global configuration from /etc/logrotate.conf, which defines default retention (rotate count), compression, frequency, and permissions, and also includes per-application drop-in files from /etc/logrotate.d/. This is the canonical file administrators edit to control retention and compression behavior system-wide.

Answer

/var/log/messages

Answer

/etc/rsyslog.conf

Answer

/etc/sysctl.conf

Question 14

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

Accepted Answer

Regular Expressions (Regex). Regular Expressions (Regex) is the most effective technique for parsing unstructured logs into structured JSON because regex allows pattern-based extraction of fields from free-form text, such as timestamps, IP addresses, usernames, and event codes. SIEM platforms like Splunk, Elastic, and Sentinel commonly use regex-based field extractions to map raw log data to a normalized taxonomy.

Answer

Manual data entry

Answer

Disabling field mapping

Answer

Using a fixed-width parser

Question 15

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

Accepted Answer

Log Aggregator. The Log Aggregator is the central component in a log management architecture that collects log data from multiple sources (e.g., servers, firewalls, applications) and normalizes it into a consistent format before storing it. Normalization ensures that disparate log formats (syslog, JSON, Windows Event Log) can be uniformly searched and analyzed. This is a core function of aggregation, distinguishing it from mere collection or storage.

Answer

End-user Workstation

Answer

Log Source

Answer

Database Engine

Question 16

Which THREE items are essential components of a robust log management policy?

Accepted Answer

Definition of log retention periods. A robust log management policy must define log retention periods (B) because regulatory, legal, and forensic requirements dictate how long logs must be preserved and when they can be securely purged. It must also specify encryption standards for log transmission (C), such as TLS 1.2/1.3 or syslog over TLS, to protect log integrity and confidentiality against interception or tampering in transit. Additionally, a log source inventory list (D) is essential to ensure comprehensive coverage by identifying every device, application, and system that generates logs, preventing blind spots in monitoring and auditing. In contrast, default login credentials (A) are a security vulnerability and should never be part of a policy, and the salary of a SOC analyst (E) is an HR matter unrelated to log management controls.

Answer

Default login credentials for all devices

Answer

The salary of the SOC analyst

Question 17

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

Accepted Answer

Generating cryptographic hashes for log files. Generating cryptographic hashes for log files creates a tamper-evident seal: any modification to the log changes its hash, which can be detected by recomputing and comparing. This is the most robust method because it provides integrity verification even if an attacker gains write access to the logs. Hashing should be done immediately after log rotation and stored separately from the logs themselves.

Answer

Storing logs on a local partition

Answer

Clearing the logs daily

Answer

Setting file permissions to read-only

Question 18

What is the primary benefit of using a centralized logging server compared to local logging?

Accepted Answer

Simplified log correlation and incident response. A centralized logging server aggregates logs from many sources into one location, enabling correlation of events across hosts, applications, and time zones — which is essential for detecting multi-stage attacks and accelerating incident response. Local logging scatters evidence across individual machines, making cross-system correlation slow or impossible during an investigation. Centralization also supports retention, tamper resistance, and compliance reporting from a single platform.

Answer

Increased disk space on the local server

Answer

Eliminating the need for a security policy

Answer

Faster network traffic speeds

Question 19

Which TWO log types are considered critical for forensic analysis after a network intrusion?

Accepted Answer

Firewall traffic logs. Firewall traffic logs (C) are critical because they record allowed and denied connections with source/destination IP addresses, ports, and timestamps, letting investigators reconstruct how an attacker entered, which hosts were targeted, and whether data exfiltration occurred. VPN authentication logs (E) are equally critical since they capture remote-access events such as usernames, source IPs, authentication successes/failures, and session durations, which can reveal compromised credentials or unauthorized remote sessions used during the intrusion. The remaining options are not forensic-relevant to a network intrusion: office wallpaper settings (A) and mouse driver version logs (D) are cosmetic or endpoint configuration data with no network activity, and printer status logs (B) only reflect print job and device health information, none of which establish attacker traffic or access.

Answer

Office wallpaper settings

Answer

Printer status logs

Answer

Mouse driver version logs

Question 20

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Accepted Answer

Extracting fields using Regex during the ingestion pipeline. Option D is correct because SIEM ingestion pipelines commonly use regular expressions (Regex) to parse raw, heterogeneous log lines and extract fields (timestamps, source IPs, usernames, event IDs) into a consistent structure during ingestion. Option E is correct because applying a standardized schema such as Common Event Format (CEF) or Elastic Common Schema (ECS) maps vendor-specific fields to a uniform naming and typing convention, which is the essence of log normalization. The unmarked options do not belong: deleting incoming log metadata (A) destroys context rather than normalizing it, increasing network MTU size (B) is a Layer 3/4 network tuning change unrelated to log parsing, and running a brute-force attack on a log file (C) is neither a normalization technique nor a legitimate SIEM practice.

Answer

Deleting all incoming log metadata

Answer

Increasing the network MTU size

Answer

Running a brute-force attack on the log file