20+ practice questions focused on Log Management — one of the most tested topics on the Certified SOC Analyst (312-39) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Log Management PracticeYou are troubleshooting a performance bottleneck in an ELK Stack deployment. Logstash is dropping events due to backpressure. Which configuration parameter in the Logstash pipeline file is best suited to manage the queue size and prevent memory overflow?
Explanation: pipeline.batch.size and pipeline.workers are key, but pipeline.ordered controls the processing flow and buffer behavior directly.
You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?
Explanation: The `wecutil es` command enumerates all active Windows Event Forwarding (WEF) subscriptions on the local machine, showing subscription names, IDs, and status. It is the correct tool for verifying whether a WEF subscription is active and healthy on a collector or source computer. This directly answers the question about checking subscription status.
A SOC uses a Syslog server to collect events from 200 Linux servers. An analyst notices that logs from a compromised server were altered after an incident. The SOC wants to ensure that future logs can be verified as unaltered from the moment they are generated. Which mechanism should be implemented on the Linux servers to provide cryptographic integrity for log entries?
Explanation: Forward Secure Sealing (FSS) in systemd-journald cryptographically seals journal entries at creation and allows later verification that they have not been altered. This meets the requirement for integrity from the moment logs are generated. Other options either protect only in transit (TLS), provide auditing without cryptographic integrity, or apply encryption only after rotation, leaving a window for tampering.
A SOC analyst is reviewing logs from a Windows Server 2019 domain controller to detect credential dumping attempts. The analyst wants to identify events that indicate the use of Mimikatz or similar tools. Which TWO Windows event IDs should the analyst prioritize for detecting credential dumping? (Choose two.)
Explanation: Sysmon Event ID 10 (ProcessAccess) is specifically designed to capture process memory access, which is a hallmark of credential dumping tools targeting LSASS. Event ID 4688 (Process Creation) can reveal the execution of credential dumping tools via command-line arguments. Together, they provide strong detection capabilities for Mimikatz-like activity. Other events, while useful for general auditing, are not as directly indicative of credential dumping.
A security analyst is configuring Windows Event Log forwarding to a central SIEM using Windows Event Forwarding (WEF). The analyst needs to ensure that the forwarded events include the original computer name and the user account associated with each event. Which Windows Event Collector subscription configuration should be used to achieve this?
Explanation: Windows Event Forwarding using the default (Normal) delivery mode preserves the original event data, including computer name and user account, provided the source event contains them. The subscription query should be configured to collect events that include these details. Other delivery modes like Minimize Bandwidth may alter data, but do not remove fields. There is no specific option to include computer name; it is inherent.
+15 more Log Management questions available
Practice all Log Management questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Log Management. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Log Management questions on the 312-39 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Log Management is tested as part of the Certified SOC Analyst (312-39) blueprint. Practicing with targeted Log Management questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free 312-39 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Log Management is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Log Management practice session with instant scoring and detailed explanations.
Start Log Management Practice →