Log Management

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

What is the primary benefit of using a centralized logging server compared to local logging?

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

A SOC analyst is reviewing Apache access logs and needs to extract only the client IP addresses and requested URLs for a threat-hunting query. The log format is the default combined format. Which approach should the analyst use to reliably parse these fields?

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

A SOC is designing a log management pipeline to ingest Windows Event Logs, Syslog from network devices, and application logs into a SIEM. The team needs to ensure that timestamps are consistent across all sources for accurate correlation. Which TWO practices are most effective for achieving time synchronization and accurate event ordering? (Choose two.)

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

A SOC analyst is reviewing logs from a web server and notices repeated requests with URLs containing encoded characters like %27 and %20. The analyst suspects a SQL injection attempt. Which log source should the analyst examine to correlate the source IP and the full request, including headers?

A SOC manager is evaluating the log retention strategy for a new SIEM deployment. Regulatory requirements mandate that all authentication logs be retained for at least one year and be available for immediate search. Which storage tier strategy best meets both the retention and accessibility requirements while optimizing cost?

Which TWO log types are considered critical for forensic analysis after a network intrusion?

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound transfer from an internal server to an external IP, but the firewall logs indicate the connection was allowed. The analyst needs to determine if the transfer was authorized by reviewing application logs. Which log source should the analyst prioritize to identify the user or process that initiated the transfer?

A SOC analyst is reviewing logs from a web server and notices that the logs contain entries with timestamps in the format '2025-04-01T14:23:45+02:00'. The SIEM is configured to display all events in UTC. What is the correct UTC time for this log entry?

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Which THREE items are essential components of a robust log management policy?

Which THREE factors should be considered when determining the log retention period in a SOC environment?

A SOC analyst must configure a Linux web server to forward its logs to a central syslog server over the network. The organization requires reliable delivery and wants to avoid losing messages if the central server is temporarily unreachable. Which TWO syslog configuration directives should the analyst use? (Choose two.)

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

A SOC team is deploying a new log management system and needs to ingest logs from various sources, including Windows Event Logs, Linux syslog, and network device logs. The team wants to ensure that all logs are parsed into a common format for easier analysis. Which component of the ELK Stack is primarily responsible for parsing and transforming logs before they are stored in Elasticsearch?

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to examine logs from a Cisco ASA firewall to identify outbound connections that may have transferred sensitive data. Which syslog severity level should the analyst configure on the ASA to capture connection-related events while minimizing log volume?

A SOC analyst is reviewing logs from a Linux server and notices that the /var/log/messages file is growing rapidly and consuming disk space. The analyst needs to ensure that logs are rotated daily and compressed, and that only the last 7 days of logs are retained. Which logrotate configuration directive should be used to achieve the retention requirement?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

A SOC analyst is configuring an ELK Stack to ingest logs from multiple sources. The analyst notices that events from different time zones are being indexed with incorrect timestamps in Elasticsearch. Which action should the analyst take to ensure events are stored with a consistent, correct time reference?

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)