Courseiva

CCNA Log Management Questions

16 questions · Log Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

A.Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/
B.Defining separate log paths for every individual IP address
C.Configuring the global log_level to debug
D.Using hardcoded static path strings only
AnswerA

Macros dynamically map incoming metadata to the directory structure.

Why this answer

The use of macros like $HOST or $YEAR allows for dynamic directory creation based on incoming log metadata.

Practice this question →
2
MCQeasy

What is the primary benefit of using a centralized logging server compared to local logging?

A.Increased disk space on the local server
B.Eliminating the need for a security policy
C.Simplified log correlation and incident response
D.Faster network traffic speeds
AnswerC

Centralization allows for correlating events across multiple sources.

Why this answer

Centralization simplifies management, enables correlation, and provides a single point of backup.

Practice this question →
3
Multi-Selecthard

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

Select 3 answers
A.Reducing the number of employees in the IT department
B.Managing high volumes of 'noise' logs that lack security value
C.Bandwidth saturation due to high log volume
D.Scaling the aggregator infrastructure to handle peak load
E.Increasing the physical size of the office building
AnswersB, C, D

Noise consumes storage and obscures real alerts.

Why this answer

Scalability, data volume/noise, and bandwidth management are the primary operational challenges.

Practice this question →
4
Multi-Selecthard

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Select 2 answers
A.Deleting all incoming log metadata
B.Increasing the network MTU size
C.Running a brute-force attack on the log file
D.Extracting fields using Regex during the ingestion pipeline
E.Applying a Common Event Format (CEF) or ECS schema
AnswersD, E

Parsing via regex transforms raw data into structured fields.

Why this answer

Normalization is typically achieved through parsing and schema mapping to a common model like ECS or CEF.

Practice this question →
5
MCQmedium

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

A.Utilizing SNMPv1 traps
B.Implementing TLS-based log forwarding
C.Encapsulating logs in cleartext UDP packets
D.Using standard port 514 without encryption
AnswerB

TLS encrypts the data stream, protecting against eavesdropping.

Why this answer

TLS encryption (via Syslog-ng or Rsyslog with TLS) ensures both confidentiality and integrity of the logs.

Practice this question →
6
Multi-Selecteasy

Which TWO log types are considered critical for forensic analysis after a network intrusion?

Select 2 answers
A.Office wallpaper settings
B.Printer status logs
C.Firewall traffic logs
D.Mouse driver version logs
E.VPN Authentication logs
AnswersC, E

Crucial for mapping communication flow and egress.

Why this answer

Authentication and Firewall logs are foundational for tracing an attacker's movement.

Practice this question →
7
MCQmedium

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

A./var/log/messages
B./etc/rsyslog.conf
C./etc/sysctl.conf
D./etc/logrotate.conf
AnswerD

This file governs the logrotate daemon's behavior.

Why this answer

/etc/logrotate.conf is the primary configuration file for defining rotation schedules and behaviors.

Practice this question →
8
Multi-Selectmedium

Which THREE items are essential components of a robust log management policy?

Select 3 answers
A.Default login credentials for all devices
B.Definition of log retention periods
C.Encryption standards for log transmission
D.Log source inventory list
E.The salary of the SOC analyst
AnswersB, C, D

Retention is a core compliance requirement.

Why this answer

A policy must define what to log, how to protect it, and for how long to keep it.

Practice this question →
9
Multi-Selectmedium

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Select 3 answers
A.Regulatory compliance requirements (e.g., GDPR, HIPAA)
B.The amount of available storage capacity
C.Average time to detect an incident (Dwell Time)
D.The color of the hardware chassis
E.The time of day the backup is scheduled
AnswersA, B, C

Laws often mandate specific retention periods.

Why this answer

Compliance requirements, storage costs, and incident investigation timelines are the primary drivers for retention.

Practice this question →
10
MCQeasy

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

A.UDP
B.TCP
C.ICMP
D.ARP
AnswerB

TCP ensures reliability through acknowledgments.

Why this answer

TCP provides a three-way handshake and acknowledgment, making it more reliable than UDP for log delivery.

Practice this question →
11
MCQeasy

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

A.Archive all logs in a local text file format only
B.Retain logs for exactly 30 days
C.Keep logs for one year, with 3 months immediately available
D.Delete logs after they are indexed in the SIEM
AnswerC

This meets the core PCI-DSS requirement for auditability.

Why this answer

PCI-DSS requires at least one year of retention, with at least three months of logs immediately available for analysis.

Practice this question →
12
MCQmedium

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

A.Regular Expressions (Regex)
B.Manual data entry
C.Disabling field mapping
D.Using a fixed-width parser
AnswerA

Regex allows for precise extraction of fields from log lines.

Why this answer

Regular Expressions (Regex) are the industry standard for extracting specific patterns from unstructured string data.

Practice this question →
13
MCQeasy

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

A.End-user Workstation
B.Log Source
C.Database Engine
D.Log Aggregator
AnswerD

The aggregator is the central hub for receiving and parsing.

Why this answer

The Log Aggregator (or collector) receives data, normalizes it, and routes it to storage.

Practice this question →
14
MCQmedium

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

A.Storing logs on a local partition
B.Generating cryptographic hashes for log files
C.Clearing the logs daily
D.Setting file permissions to read-only
AnswerB

Hashing allows you to detect unauthorized changes.

Why this answer

Cryptographic hashing of log files at intervals provides an verifiable proof of log integrity.

Practice this question →
15
MCQhard

You notice that your SIEM is not receiving logs from a Windows domain controller. After verifying network connectivity, you check the Windows Event Forwarding (WEF) subscription status. Which command is used to check the status of active subscriptions on the local machine?

A.wmic eventlog
B.winrm get config
C.gpresult /r
D.wecutil es
AnswerD

wecutil es displays the status of event subscriptions.

Why this answer

wecutil es (enum-subscriptions) is the standard utility for managing and checking WEF subscriptions.

Practice this question →
16
MCQhard

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

A.Simple Queue Service (SQS)
B.Kinesis Firehose
C.CloudWatch Unified Agent
D.AWS Config
AnswerC

The Unified Agent is specifically designed for cross-environment collection.

Why this answer

The Unified CloudWatch Agent is designed to collect logs and metrics from both EC2 and on-premises servers.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Log Management questions.

Start 20-question session