Courseiva

CCNA Log Management Questions

32 questions · Log Management · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

A.Configure a filter in the SIEM to drop all SSH failure logs from the authentication server.
B.Use log deduplication and correlation rules in the SIEM to group repeated SSH failures from the same source into a single alert with a count.
C.Implement log aggregation with rate limiting on the syslog server to cap the number of SSH failure messages per second.
D.Disable SSH logging on the authentication server and rely solely on network flow data for anomaly detection.
AnswerB

Deduplication and correlation reduce noise by aggregating repeated events into a single alert with an occurrence count, preserving the original logs for forensic analysis while minimizing pipeline load. This maintains visibility into the number of attempts and source IPs, enabling detection of brute-force patterns without overwhelming the SIEM.

Why this answer

Deduplication and correlation in the SIEM reduce alert volume by grouping repeated events while retaining the original logs for forensic analysis. This approach maintains visibility into attack patterns such as brute-force attempts without overwhelming the ingestion pipeline. It balances operational efficiency with the need for detailed security context, unlike dropping or limiting logs.

Exam trap

The trap here is assuming that reducing log volume always requires discarding data, when in fact aggregation and deduplication can preserve forensic value.

Practice this question →
2
MCQmedium

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

A.Utilizing template macros such as /var/log/$HOST/$YEAR/$MONTH/
B.Defining separate log paths for every individual IP address
C.Configuring the global log_level to debug
D.Using hardcoded static path strings only
AnswerA

Template macros expand per-message at runtime, so $HOST resolves to each device's hostname and dynamically builds a separate directory path for every department's logs. This satisfies the stem's requirement to segregate files by hostname without defining a destination per device, unlike static paths or filters that cannot vary output location per sender.

Why this answer

syslog-ng destination paths support template macros such as $HOST, $YEAR, $MONTH, $DAY, and $PROGRAM, which are expanded at runtime for each message. Using /var/log/$HOST/$YEAR/$MONTH/ dynamically creates per-host directories, satisfying the requirement to separate logs by hostname without manual configuration.

Exam trap

312-39 often tests the misconception that static paths or per-IP log paths are the way to segregate logs — candidates overlook syslog-ng's template macro system, which is the idiomatic and scalable solution.

How to eliminate wrong answers

Option B is wrong because defining a separate log path per IP address is unscalable, brittle, and does not use hostname as the discriminator — it also breaks when IPs change via DHCP. Option C is wrong because log_level controls verbosity of syslog-ng's own internal messages, not destination path structure. Option D is wrong because hardcoded static paths would write all hosts to the same directory, defeating the requirement entirely.

Practice this question →
3
MCQeasy

What is the primary benefit of using a centralized logging server compared to local logging?

A.Increased disk space on the local server
B.Eliminating the need for a security policy
C.Simplified log correlation and incident response
D.Faster network traffic speeds
AnswerC

Centralised collection aggregates events from multiple hosts into one repository, letting analysts correlate related entries across systems and reconstruct an incident timeline quickly. Local logging scatters evidence per machine, so this correlation and coordinated response become slow and error-prone.

Why this answer

A centralized logging server aggregates logs from many sources into one location, enabling correlation of events across hosts, applications, and time zones — which is essential for detecting multi-stage attacks and accelerating incident response. Local logging scatters evidence across individual machines, making cross-system correlation slow or impossible during an investigation. Centralization also supports retention, tamper resistance, and compliance reporting from a single platform.

Exam trap

The trap is picking a tangential operational benefit (disk space, speed) instead of the core security value — correlation and faster incident response — which is what centralized logging is fundamentally designed to deliver.

How to eliminate wrong answers

Option A is wrong because centralization actually consumes additional storage on the aggregator and typically increases, not decreases, total storage footprint — freeing local disk is a side effect, not the primary benefit. Option B is wrong because a security policy is still required to define what is logged, retention periods, access controls, and handling procedures; a logging server does not replace governance. Option D is wrong because centralized logging adds network traffic (log shipping) and does not improve network throughput — if anything, it can compete for bandwidth.

Practice this question →
4
Multi-Selecthard

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

Select 3 answers
A.Reducing the number of employees in the IT department
B.Managing high volumes of 'noise' logs that lack security value
C.Bandwidth saturation due to high log volume
D.Scaling the aggregator infrastructure to handle peak load
E.Increasing the physical size of the office building
AnswersB, C, D

Centralised aggregation pulls in every device's syslog, including verbose debug and informational entries, so analysts must filter enormous volumes of low-value noise to surface genuine security events. This directly addresses the challenge of separating signal from irrelevant data at enterprise scale.

Why this answer

Option B is correct because centralized log management in a large enterprise ingests telemetry from many sources, and a large proportion of those events are low-value or duplicate 'noise' logs (e.g., routine debug, verbose application chatter) that must be filtered, tuned, or dropped to keep the SIEM useful. Option C is correct because shipping raw log streams from hundreds or thousands of hosts, appliances, and cloud services to a central collector consumes significant network bandwidth, and without compression, batching, or filtering this can saturate WAN or inter-DC links. Option D is correct because the aggregator/indexer tier (e.g., syslog relays, Kafka brokers, Elasticsearch clusters) must be sized and horizontally scaled to absorb peak ingestion rates and query loads, which is a well-known operational challenge.

Option A is not a challenge of centralized log management; log centralization is about collection, correlation, and retention, not headcount reduction. Option E is unrelated, since log management concerns logical data storage and network capacity, not the physical dimensions of office space.

Exam trap

The trap is being distracted by plausible-sounding but irrelevant business options (headcount, office size) when the question asks specifically about technical challenges of centralized log management.

Practice this question →
5
MCQeasy

A SOC analyst is reviewing Apache access logs and needs to extract only the client IP addresses and requested URLs for a threat-hunting query. The log format is the default combined format. Which approach should the analyst use to reliably parse these fields?

A.Split each log line on the pipe character and select the first and second fields.
B.Use a regular expression that matches the client IP at the start of the line and the request path inside the first quoted string.
C.Extract the fields by counting characters from the beginning of each line based on fixed column widths.
D.Use a JSON parser because Apache access logs are natively emitted as JSON objects.
AnswerB

The Apache combined log format places the client IP as the first space-delimited field and the request line (method, path, protocol) inside the first pair of double quotes. A regex anchored to these positions reliably extracts the IP and URL without being confused by other quoted fields such as the referrer or user agent.

Why this answer

The Apache combined log format is a well-defined text structure where the client IP is the first token and the request URL is inside the first quoted string. A regex that targets these positions extracts the desired fields accurately and is robust to variations in later fields such as referrer and user agent, unlike delimiter or fixed-width approaches.

Exam trap

The trap here is assuming that a generic delimiter-based split will work on Apache logs, when the combined format actually uses spaces and quotes in a way that requires positional pattern matching.

Practice this question →
6
Multi-Selecthard

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

Select 2 answers
A.Deleting all incoming log metadata
B.Increasing the network MTU size
C.Running a brute-force attack on the log file
D.Extracting fields using Regex during the ingestion pipeline
E.Applying a Common Event Format (CEF) or ECS schema
AnswersD, E

Regex extraction parses raw log events during ingestion, pulling discrete fields such as timestamps, source IPs and usernames into a common schema. This transforms heterogeneous vendor formats into consistent, searchable fields, which is the essence of log normalisation in a SIEM.

Why this answer

Option D is correct because SIEM ingestion pipelines commonly use regular expressions (Regex) to parse raw, heterogeneous log lines and extract fields (timestamps, source IPs, usernames, event IDs) into a consistent structure during ingestion. Option E is correct because applying a standardized schema such as Common Event Format (CEF) or Elastic Common Schema (ECS) maps vendor-specific fields to a uniform naming and typing convention, which is the essence of log normalization. The unmarked options do not belong: deleting incoming log metadata (A) destroys context rather than normalizing it, increasing network MTU size (B) is a Layer 3/4 network tuning change unrelated to log parsing, and running a brute-force attack on a log file (C) is neither a normalization technique nor a legitimate SIEM practice.

Exam trap

The trap is selecting options that sound technical but are irrelevant (MTU, brute force) — candidates must recognize that normalization is about parsing and schema mapping, not network or offensive operations.

Practice this question →
7
Multi-Selecthard

A SOC is designing a log management pipeline to ingest Windows Event Logs, Syslog from network devices, and application logs into a SIEM. The team needs to ensure that timestamps are consistent across all sources for accurate correlation. Which TWO practices are most effective for achieving time synchronization and accurate event ordering? (Choose two.)

Select 2 answers
A.Configure all log sources to use NTP with authenticated time sources to maintain accurate clocks.
B.Normalize all timestamps to UTC at the collection point before storing them in the SIEM.
C.Configure log sources to send logs only when their clocks are within 1 second of the SIEM's clock.
D.Use the SIEM's internal ingestion timestamp as the primary event time for all logs.
E.Enable high-precision timestamps with nanosecond granularity on all log sources.
AnswersA, B

NTP ensures that all devices have synchronized clocks, which is fundamental for correlating events across different log sources. Using authenticated NTP prevents time spoofing. Without synchronized clocks, timestamps can drift, causing events to appear out of order and breaking correlation rules. This practice directly addresses the root cause of timestamp inconsistency.

Why this answer

Accurate time synchronization and normalization are essential for correlating events across heterogeneous log sources. NTP with authentication ensures clocks are aligned, while normalizing to UTC provides a consistent reference. Together, they enable the SIEM to order events correctly and correlate activity across Windows, syslog, and application logs, which is critical for incident detection and forensic analysis.

Exam trap

The trap here is focusing on timestamp precision or ingestion time rather than actual clock synchronization and time zone normalization.

Practice this question →
8
MCQmedium

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

A.Utilizing SNMPv1 traps
B.Implementing TLS-based log forwarding
C.Encapsulating logs in cleartext UDP packets
D.Using standard port 514 without encryption
AnswerB

TLS-based forwarding encrypts syslog or log payloads in transit using certificates, providing confidentiality and integrity between the remote web server and the SIEM. Plain TCP or UDP syslog sends cleartext, so TLS satisfies the requirement for the highest protection during transmission.

Why this answer

TLS-based log forwarding encrypts log data in transit, ensuring confidentiality and integrity. It uses certificates for authentication and encryption, protecting against eavesdropping and tampering. This is the most secure method among the options.

Exam trap

The trap is choosing SNMPv1 or syslog on port 514 because they are common logging mechanisms, but they lack encryption; candidates might overlook the need for encryption in transit.

How to eliminate wrong answers

Option A is wrong because SNMPv1 traps are sent in cleartext and lack encryption, making them vulnerable to interception. Option C is wrong because cleartext UDP packets offer no encryption or integrity protection. Option D is wrong because standard port 514 (syslog) without encryption transmits logs in plaintext, easily sniffed.

Practice this question →
9
MCQmedium

A SOC analyst is reviewing logs from a web server and notices repeated requests with URLs containing encoded characters like %27 and %20. The analyst suspects a SQL injection attempt. Which log source should the analyst examine to correlate the source IP and the full request, including headers?

A.Web server error logs
B.Firewall logs
C.Database server logs
D.Web server access logs
AnswerD

Web server access logs, such as Apache's access.log or IIS logs, record each HTTP request with the source IP, timestamp, request method, URL, and status code. They capture the full URL including encoded characters, allowing the analyst to identify SQL injection patterns. By correlating the source IP across multiple requests, the analyst can determine if the activity is malicious. Access logs are the primary source for web request analysis.

Why this answer

Web server access logs are the correct source because they record each HTTP request with the source IP, full URL including encoded characters, and other request details. This allows the analyst to correlate multiple requests from the same IP and identify SQL injection patterns. Error logs, database logs, and firewall logs lack the necessary application-layer context to fully reconstruct the attack.

Exam trap

The trap here is assuming that database logs would show the injection, but they often lack the source IP and full HTTP request context needed for correlation.

Practice this question →
10
MCQmedium

A SOC manager is evaluating the log retention strategy for a new SIEM deployment. Regulatory requirements mandate that all authentication logs be retained for at least one year and be available for immediate search. Which storage tier strategy best meets both the retention and accessibility requirements while optimizing cost?

A.Store all authentication logs in a hot tier for one year.
B.Archive all logs to tape for one year and retrieve them on demand.
C.Store logs in a warm tier for 30 days, then move to a cold tier for the remainder of the year.
D.Store logs in a hot tier for 90 days, then transition to a warm tier that supports immediate search for the remaining retention period.
AnswerD

A hot tier for recent logs ensures fast search for active investigations. Transitioning to a warm tier, which still supports immediate search but at lower cost, meets the one-year retention with accessibility. This balances performance and cost, as warm storage is cheaper than hot but remains searchable.

Why this answer

A tiered storage strategy with a hot tier for recent logs and a warm tier for older logs balances cost and accessibility. Hot storage provides fast search for recent data, while warm storage offers immediate search at a lower cost for the remainder of the retention period. This meets both regulatory retention and immediate accessibility requirements.

Exam trap

The trap here is assuming that cold storage or tape can provide immediate search, when they typically require restoration delays.

Practice this question →
11
Multi-Selecteasy

Which TWO log types are considered critical for forensic analysis after a network intrusion?

Select 2 answers
A.Office wallpaper settings
B.Printer status logs
C.Firewall traffic logs
D.Mouse driver version logs
E.VPN Authentication logs
AnswersC, E

Firewall traffic logs record permitted and denied connections with source, destination, port and timestamp, letting investigators reconstruct the intrusion's ingress path, lateral movement and exfiltration attempts. This session-level evidence is essential for scoping the breach and identifying compromised hosts.

Why this answer

Firewall traffic logs (C) are critical because they record allowed and denied connections with source/destination IP addresses, ports, and timestamps, letting investigators reconstruct how an attacker entered, which hosts were targeted, and whether data exfiltration occurred. VPN authentication logs (E) are equally critical since they capture remote-access events such as usernames, source IPs, authentication successes/failures, and session durations, which can reveal compromised credentials or unauthorized remote sessions used during the intrusion. The remaining options are not forensic-relevant to a network intrusion: office wallpaper settings (A) and mouse driver version logs (D) are cosmetic or endpoint configuration data with no network activity, and printer status logs (B) only reflect print job and device health information, none of which establish attacker traffic or access.

Exam trap

312-39 often tests whether candidates can identify network-layer evidence sources, distracting them with plausible-sounding but irrelevant device or user-preference logs.

Practice this question →
12
MCQhard

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound transfer from an internal server to an external IP, but the firewall logs indicate the connection was allowed. The analyst needs to determine if the transfer was authorized by reviewing application logs. Which log source should the analyst prioritize to identify the user or process that initiated the transfer?

A.Windows Security Event Logs on the internal server
B.Firewall logs showing the allowed connection
C.NetFlow records from the network core
D.Application logs from the server that initiated the transfer
AnswerD

Application logs typically record user actions, process IDs, and commands, providing the necessary context to identify who or what initiated the transfer. They can show authentication, file access, and transfer commands. This is the most direct source to determine if the transfer was authorized and by which user or process.

Why this answer

Application logs are the most direct source for identifying the user or process that initiated a data transfer. They capture application-level events, including authentication, file access, and commands, which can reveal whether the transfer was authorized. Firewall and NetFlow logs lack this granularity, and Windows Security logs may not capture the specific action.

Exam trap

The trap here is assuming that network-level logs (firewall, NetFlow) can identify the user or process, when they only show connection metadata.

Practice this question →
13
MCQeasy

A SOC analyst is reviewing logs from a web server and notices that the logs contain entries with timestamps in the format '2025-04-01T14:23:45+02:00'. The SIEM is configured to display all events in UTC. What is the correct UTC time for this log entry?

A.2025-04-01 16:23:45 UTC
B.2025-04-01 14:23:45 UTC
C.2025-04-01 12:23:45 UTC
D.2025-04-01 14:23:45 local time, no conversion needed
AnswerC

The timestamp includes a +02:00 offset, meaning the local time is two hours ahead of UTC. To convert to UTC, subtract two hours from the local time. Thus, 14:23:45 becomes 12:23:45 UTC. This correctly accounts for the time zone offset and ensures the event is ordered accurately in the SIEM.

Why this answer

The log entry has a +02:00 offset, indicating the local time is two hours ahead of UTC. To convert to UTC, subtract two hours, resulting in 12:23:45 UTC. This normalization is essential for the SIEM to correctly order and correlate events from multiple sources with different time zones.

Exam trap

The trap here is misinterpreting the sign of the time zone offset, leading to adding instead of subtracting hours.

Practice this question →
14
MCQmedium

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

A./var/log/messages
B./etc/rsyslog.conf
C./etc/sysctl.conf
D./etc/logrotate.conf
AnswerD

/etc/logrotate.conf is logrotate's primary configuration file, holding global directives such as rotation frequency, retention count and compression. It satisfies the stem's requirement for defining retention and compression settings, and typically includes per-application stanzas from /etc/logrotate.d/, making it the correct location.

Why this answer

The logrotate utility reads its global configuration from /etc/logrotate.conf, which defines default retention (rotate count), compression, frequency, and permissions, and also includes per-application drop-in files from /etc/logrotate.d/. This is the canonical file administrators edit to control retention and compression behavior system-wide.

Exam trap

The trap is confusing rsyslog's configuration file (/etc/rsyslog.conf), which controls log routing, with logrotate's configuration file (/etc/logrotate.conf), which controls retention and compression.

How to eliminate wrong answers

Option A is wrong because /var/log/messages is an actual log file, not a configuration file. Option B is wrong because /etc/rsyslog.conf configures the rsyslog daemon's rules for which messages go to which files, not rotation or retention. Option C is wrong because /etc/sysctl.conf tunes kernel parameters at runtime and has nothing to do with log rotation.

Practice this question →
15
Multi-Selectmedium

Which THREE items are essential components of a robust log management policy?

Select 3 answers
A.Default login credentials for all devices
B.Definition of log retention periods
C.Encryption standards for log transmission
D.Log source inventory list
E.The salary of the SOC analyst
AnswersB, C, D

Defining retention periods satisfies legal, regulatory and storage constraints by specifying how long each log class is kept before archival or deletion. Without explicit retention, logs either accumulate indefinitely or are purged prematurely, undermining forensic investigations and compliance audits.

Why this answer

A robust log management policy must define log retention periods (B) because regulatory, legal, and forensic requirements dictate how long logs must be preserved and when they can be securely purged. It must also specify encryption standards for log transmission (C), such as TLS 1.2/1.3 or syslog over TLS, to protect log integrity and confidentiality against interception or tampering in transit. Additionally, a log source inventory list (D) is essential to ensure comprehensive coverage by identifying every device, application, and system that generates logs, preventing blind spots in monitoring and auditing.

In contrast, default login credentials (A) are a security vulnerability and should never be part of a policy, and the salary of a SOC analyst (E) is an HR matter unrelated to log management controls.

Practice this question →
16
Multi-Selectmedium

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Select 3 answers
A.Regulatory compliance requirements (e.g., GDPR, HIPAA)
B.The amount of available storage capacity
C.Average time to detect an incident (Dwell Time)
D.The color of the hardware chassis
E.The time of day the backup is scheduled
AnswersA, B, C

Legal and industry frameworks mandate minimum retention windows; GDPR, HIPAA and PCI DSS each prescribe distinct periods and breach-investigation obligations. Aligning SOC retention with these requirements satisfies the stem's compliance factor, preventing premature deletion of evidence needed for audits, legal holds or regulatory reporting.

Why this answer

Option A is correct because regulatory frameworks such as GDPR, HIPAA, PCI DSS, and SOX impose explicit minimum retention periods for audit and security logs, so the SOC must retain logs at least as long as the strictest applicable mandate requires. Option B is correct because log retention is bounded by available storage capacity; the volume of logs generated per day, combined with the retention window, determines the storage and archiving infrastructure needed, and insufficient capacity forces trade-offs such as shorter retention or tiered storage. Option C is correct because the average time to detect an incident (dwell time) defines how far back investigators must be able to look to reconstruct an intrusion; if logs are purged before the typical detection window, the SOC loses the evidence needed for detection, triage, and root-cause analysis.

Option D is not relevant because the physical color of hardware chassis has no bearing on log retention policy or security requirements. Option E is not relevant because the scheduled time of day for backups affects backup operations, not the duration for which logs must be retained.

Exam trap

The trap is that candidates focus only on compliance and forget operational factors like storage capacity and dwell time, or they pick irrelevant options that sound technical but have no impact on retention policy.

Practice this question →
17
Multi-Selecthard

A SOC analyst must configure a Linux web server to forward its logs to a central syslog server over the network. The organization requires reliable delivery and wants to avoid losing messages if the central server is temporarily unreachable. Which TWO syslog configuration directives should the analyst use? (Choose two.)

Select 2 answers
A.Increase the size of the /var/log partition to 500 GB to accommodate log growth.
B.Set the facility to local7 and the severity to debug for all forwarded messages.
C.Configure log rotation with a daily schedule and compress rotated files.
D.Configure the syslog daemon to use TCP instead of UDP for forwarding.
E.Enable the syslog daemon's disk-assisted queue so unsent messages are spooled to disk during outages.
AnswersD, E

TCP provides connection-oriented delivery with acknowledgments, so the sending syslog daemon can detect when the central server is unreachable and retry or queue messages. UDP, by contrast, offers no delivery guarantee and can silently drop messages during network congestion or brief outages, making TCP the appropriate choice when reliability is required.

Why this answer

Reliable syslog forwarding requires a transport that can detect failures and a mechanism to buffer messages during outages. TCP provides acknowledged delivery, and a disk-assisted queue persists messages until the remote server is reachable, together preventing message loss. Facility, severity, disk size, and rotation settings affect categorization and local storage but not delivery reliability.

Exam trap

The trap here is focusing on local log storage or message categorization settings, which feel relevant to log management but do nothing to guarantee delivery to a remote syslog server during an outage.

Practice this question →
18
MCQeasy

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

A.UDP
B.TCP
C.ICMP
D.ARP
AnswerB

TCP provides connection-oriented, acknowledged delivery, so the collector retransmits lost segments until the aggregator confirms receipt. This satisfies the stem's requirement for delivery confirmation between collector and aggregator, unlike connectionless UDP, which offers no acknowledgement and silently drops logs under congestion.

Why this answer

TCP is the preferred protocol for centralized log transmission because it is connection-oriented and provides acknowledgements (ACKs) for every segment delivered, guaranteeing that logs arrive at the aggregator intact and in order. This delivery confirmation is essential for compliance and forensic integrity, where lost log entries can create dangerous blind spots. UDP offers no such guarantee, making it unsuitable when reliable delivery is a requirement.

Exam trap

The trap here is assuming UDP is 'faster and therefore better' for high-volume logging, when the question's key phrase 'delivery confirmation' explicitly points to TCP's acknowledgement mechanism.

How to eliminate wrong answers

Option A is wrong because UDP is connectionless and fire-and-forget — it has no acknowledgement mechanism, so packets can be silently dropped under load, which is unacceptable when delivery confirmation is required. Option C is wrong because ICMP is a control/diagnostic protocol (ping, traceroute, unreachable messages) and is not designed to carry application log payloads. Option D is wrong because ARP operates at Layer 2 to resolve IP addresses to MAC addresses on a local segment and has nothing to do with transporting log data between hosts.

Practice this question →
19
MCQmedium

A SOC team is deploying a new log management system and needs to ingest logs from various sources, including Windows Event Logs, Linux syslog, and network device logs. The team wants to ensure that all logs are parsed into a common format for easier analysis. Which component of the ELK Stack is primarily responsible for parsing and transforming logs before they are stored in Elasticsearch?

A.Logstash
B.Kibana
C.Beats
D.Elasticsearch
AnswerA

Logstash is the data processing pipeline of the ELK Stack. It ingests data from multiple sources, parses and transforms it using filters (e.g., grok, mutate), and outputs it to a destination like Elasticsearch. In this scenario, Logstash is the component that would parse Windows Event Logs, syslog, and network logs into a common format, making it the correct answer.

Why this answer

Logstash is the component in the ELK Stack responsible for parsing and transforming logs. It uses input plugins to collect data, filters like grok to parse unstructured logs, and output plugins to send data to Elasticsearch. While Beats can collect and do minor processing, Logstash is designed for complex transformations, making it the primary choice for normalizing diverse logs.

Exam trap

The trap here is confusing data collection with data parsing; Beats collects logs but Logstash is the one that parses and transforms them.

Practice this question →
20
MCQeasy

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

A.Archive all logs in a local text file format only
B.Retain logs for exactly 30 days
C.Keep logs for one year, with 3 months immediately available
D.Delete logs after they are indexed in the SIEM
AnswerC

PCI-DSS requires audit trail history retention of at least twelve months, with the most recent three months immediately available for analysis. Keeping logs for one year with three months online satisfies both the retention duration and the rapid-access constraint that auditors and incident responders demand.

Why this answer

PCI-DSS requirement 10.7 mandates retaining audit logs for at least one year, with a minimum of three months immediately available for analysis. This ensures that logs are accessible for forensic investigations and compliance audits, while older logs can be archived but must be retrievable.

Exam trap

The trap is selecting a shorter retention period like 30 days because it's a common practice, but PCI-DSS explicitly requires one year; candidates might also think logs can be deleted after indexing, but that's not allowed.

How to eliminate wrong answers

Option A is wrong because archiving logs only in local text file format is not a requirement; logs can be stored in various formats, and local storage may not be secure or scalable. Option B is wrong because exactly 30 days is insufficient; PCI-DSS requires at least one year. Option D is wrong because deleting logs after indexing in the SIEM violates retention requirements; logs must be retained for the mandated period.

Practice this question →
21
MCQhard

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to examine logs from a Cisco ASA firewall to identify outbound connections that may have transferred sensitive data. Which syslog severity level should the analyst configure on the ASA to capture connection-related events while minimizing log volume?

A.Severity level 6 (Informational)
B.Severity level 4 (Warnings)
C.Severity level 7 (Debugging)
D.Severity level 3 (Errors)
AnswerA

Cisco ASA syslog severity level 6 (Informational) includes messages about normal but significant conditions, such as connection built and teardown events (e.g., %ASA-6-302013, %ASA-6-302014). These are essential for tracking outbound connections and identifying potential data exfiltration. Configuring level 6 captures these events without the excessive volume of level 7 (Debugging), which includes detailed packet-level information rarely needed for this analysis.

Why this answer

Cisco ASA syslog severity level 6 (Informational) includes connection-related messages such as built and teardown events, which are vital for tracking outbound connections during a data exfiltration investigation. Higher levels like 7 add excessive debugging noise, while lower levels like 4 or 3 omit these informational events. Therefore, level 6 provides the necessary balance of detail and volume.

Exam trap

The trap here is assuming that a higher severity level (lower number) captures more events; in syslog, lower numbers are more severe but less verbose, so level 6 is needed for connection details.

Practice this question →
22
MCQhard

A SOC analyst is reviewing logs from a Linux server and notices that the /var/log/messages file is growing rapidly and consuming disk space. The analyst needs to ensure that logs are rotated daily and compressed, and that only the last 7 days of logs are retained. Which logrotate configuration directive should be used to achieve the retention requirement?

A.rotate 7
B.maxage 7
C.daily
D.size 7M
AnswerA

The rotate directive specifies how many times logs are rotated before being removed. Setting rotate 7 means that after 7 rotations, the oldest log is deleted. If logrotate runs daily, this retains 7 days of logs. Combined with compress, it meets the requirement. This is the correct directive to control retention count.

Why this answer

The rotate directive controls how many rotated log files are kept. Setting rotate 7 with daily rotation retains 7 days of logs, as each day a new rotation occurs and the oldest is deleted. The compress option would further reduce space.

Other directives like daily set frequency, maxage sets age-based deletion, and size sets size-based rotation, but rotate is the specific directive for retention count.

Exam trap

The trap here is confusing rotation frequency with retention count; daily sets when to rotate, but rotate sets how many to keep.

Practice this question →
23
MCQeasy

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

A.Windows Security event log
B.Windows Application event log
C.Sysmon Event ID 3 (Network connection)
D.Windows PowerShell operational log
AnswerC

Sysmon Event ID 3 logs network connections, including the source and destination IP addresses, ports, and the process ID and image path of the process that initiated the connection. This directly provides the correlation between outbound connections and processes, making it ideal for investigating potential data exfiltration.

Why this answer

Sysmon Event ID 3 is specifically designed to log network connections along with the initiating process information. This makes it the most suitable log source for correlating outbound connections with processes during a data exfiltration investigation. Other logs either lack network connection details or do not associate connections with processes.

Exam trap

The trap here is assuming that the Windows Security event log or PowerShell logs contain comprehensive network connection data, when in fact Sysmon provides the needed process-to-connection mapping.

Practice this question →
24
MCQhard

A SOC analyst is configuring an ELK Stack to ingest logs from multiple sources. The analyst notices that events from different time zones are being indexed with incorrect timestamps in Elasticsearch. Which action should the analyst take to ensure events are stored with a consistent, correct time reference?

A.Use a mutate filter to add the local time zone offset as a separate field and rely on Kibana to adjust display times.
B.Configure a date filter in Logstash that parses the original timestamp and converts it to UTC before assigning it to the @timestamp field.
C.Set the Elasticsearch cluster's timezone setting to the SOC's local time zone in elasticsearch.yml.
D.Configure filebeat to append a timestamp with the local system time and disable Logstash date parsing.
AnswerB

Elasticsearch stores @timestamp in UTC internally, so the correct approach is to parse each source's original time zone in Logstash and normalize it to UTC. The date filter with the appropriate timezone setting ensures the @timestamp field reflects the actual event time regardless of the source's local time zone, producing consistent indexing and accurate searches.

Why this answer

Because Elasticsearch stores @timestamp in UTC, the ingestion pipeline must convert each source's original time to UTC. Logstash's date filter, configured with the source's time zone and the correct format, achieves this by parsing the event's own timestamp and writing a normalized UTC value, ensuring all sources align on a single timeline for searching and correlation.

Exam trap

The trap here is assuming that changing a cluster or display time zone setting will correct event times, when the real fix must happen during parsing so that @timestamp is stored as an accurate UTC value.

Practice this question →
25
MCQhard

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

A.Application log, Event ID 1000
B.Security log, Event ID 4688
C.System log, Event ID 7045
D.Windows PowerShell log, Event ID 4104
AnswerB

Event ID 4688 in the Security log records process creation. When process creation auditing is enabled, it includes the full command line of the new process, provided the 'Include command line in process creation events' policy is turned on. For PowerShell, this event captures the exact command line used, which is critical for understanding the script or commands executed. This makes it the correct source for retrieving the command line.

Why this answer

To retrieve the full command line of a PowerShell process, the analyst should examine Security log Event ID 4688, which records process creation and includes command-line data when the appropriate audit policy is enabled. Other events like 7045, 1000, or 4104 serve different purposes and do not reliably capture the command line. Event ID 4688 is the standard source for process command-line auditing.

Exam trap

The trap here is assuming that PowerShell script block logging (Event ID 4104) captures the full command line, but it records script content, not the exact command line used to launch the process.

Practice this question →
26
MCQmedium

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

A.Logon Type 5
B.Logon Type 4
C.Logon Type 10
D.Logon Type 2
AnswerD

Logon Type 2 represents an interactive logon, where a user physically types credentials at the console of a workstation or server. Brute-force attacks against workstations typically involve repeated interactive logon attempts, generating Event ID 4625 with Logon Type 2. Filtering for this type helps isolate attempts to guess local or domain credentials directly at the machine, distinguishing them from network-based or service logons.

Why this answer

Interactive brute-force attacks against workstations generate Windows Security Event ID 4625 with Logon Type 2, which indicates a user attempted to log on at the physical console. Other logon types correspond to different access methods: Type 3 for network, Type 4 for batch, Type 5 for service, and Type 10 for RDP. Focusing on Type 2 allows the analyst to isolate local interactive password-guessing attempts.

Exam trap

The trap here is confusing Logon Type 3 (network) with interactive logons, because network logons are common in brute-force attacks, but the scenario specifies workstations where interactive attempts are the target.

Practice this question →
27
MCQmedium

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

A.Regular Expressions (Regex)
B.Manual data entry
C.Disabling field mapping
D.Using a fixed-width parser
AnswerA

Regex extracts named capture groups from raw log lines, letting you map each field to SIEM taxonomy entries. It handles the unstructured, variable-format input the stem describes, unlike delimiter or fixed-position parsing that assume consistent structure.

Why this answer

Regular Expressions (Regex) is the most effective technique for parsing unstructured logs into structured JSON because regex allows pattern-based extraction of fields from free-form text, such as timestamps, IP addresses, usernames, and event codes. SIEM platforms like Splunk, Elastic, and Sentinel commonly use regex-based field extractions to map raw log data to a normalized taxonomy.

Exam trap

EC-Council often tests whether candidates understand that unstructured logs require pattern-based extraction (regex) rather than fixed-width or manual methods — candidates may pick fixed-width because it sounds simpler, but it fails on variable-length logs.

How to eliminate wrong answers

Option B is wrong because manual data entry is not scalable, error-prone, and impractical for high-volume log ingestion — it defeats the purpose of automated SIEM parsing. Option C is wrong because disabling field mapping would leave logs unstructured and unsearchable, preventing correlation and analysis in the SIEM. Option D is wrong because a fixed-width parser only works for logs with consistent, column-aligned formats (e.g., some mainframe or legacy logs) and fails on variable-length unstructured logs.

Practice this question →
28
MCQeasy

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

A.End-user Workstation
B.Log Source
C.Database Engine
D.Log Aggregator
AnswerD

A log aggregator receives raw log streams from dispersed network nodes, then parses and normalises each into a common schema before forwarding to storage. This directly satisfies the stem's two requirements: centralised collection from varied sources and format standardisation prior to persistence.

Why this answer

The Log Aggregator is the central component in a log management architecture that collects log data from multiple sources (e.g., servers, firewalls, applications) and normalizes it into a consistent format before storing it. Normalization ensures that disparate log formats (syslog, JSON, Windows Event Log) can be uniformly searched and analyzed. This is a core function of aggregation, distinguishing it from mere collection or storage.

Exam trap

The trap here is confusing the log source (where logs originate) with the log aggregator (which receives and normalizes them); candidates often pick 'Log Source' because it sounds like it handles logs, but it does not perform normalization or central collection.

How to eliminate wrong answers

Option A is wrong because an End-user Workstation is typically a log source, not a component that receives and normalizes logs from various nodes. Option B is wrong because a Log Source is the origin of log data (e.g., a server or application), not the component that receives and normalizes it. Option C is wrong because a Database Engine is used for storing and querying structured data, but it does not inherently receive logs from network nodes or normalize their formats; that is the role of the aggregator before storage.

Practice this question →
29
MCQmedium

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

A.Storing logs on a local partition
B.Generating cryptographic hashes for log files
C.Clearing the logs daily
D.Setting file permissions to read-only
AnswerB

Cryptographic hashes act as tamper-evident seals: any modification to a log file changes its hash, so recomputing and comparing against a stored baseline reliably detects alteration. This provides stronger integrity assurance than access controls or plain checksums, which cannot resist deliberate tampering.

Why this answer

Generating cryptographic hashes for log files creates a tamper-evident seal: any modification to the log changes its hash, which can be detected by recomputing and comparing. This is the most robust method because it provides integrity verification even if an attacker gains write access to the logs. Hashing should be done immediately after log rotation and stored separately from the logs themselves.

Exam trap

The trap is assuming that file permissions or local storage provide integrity, when only cryptographic verification can detect tampering after the fact.

How to eliminate wrong answers

Option A is wrong because storing logs on a local partition does not prevent tampering — an attacker with sufficient privileges can modify or delete them. Option C is wrong because clearing logs daily destroys evidence and does not provide integrity; it actually hinders investigations. Option D is wrong because read-only permissions can be bypassed by root or an attacker who escalates privileges, and they do not provide a detection mechanism for tampering that occurred before permissions were set.

Practice this question →
30
MCQhard

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

A.Simple Queue Service (SQS)
B.Kinesis Firehose
C.CloudWatch Unified Agent
D.AWS Config
AnswerC

The CloudWatch Unified Agent collects metrics and logs in one package and can stream on-premises log files to CloudWatch Logs via its logs section. It satisfies the forwarding requirement, unlike the older CloudWatch Logs agent or SSM Agent.

Why this answer

The CloudWatch Unified Agent (formerly the unified CloudWatch agent) is the AWS-supported agent that runs on on-premises servers and can collect and forward logs (and metrics) to CloudWatch Logs over the public AWS endpoints. It supports both the logs and metrics plugins in a single agent, making it the correct choice for streaming on-premises logs into CloudWatch. The other options are AWS services, not agents installed on a server.

Exam trap

The trap is confusing AWS managed services (SQS, Kinesis Firehose, Config) with the actual agent software that must be installed on the on-premises server to ship logs — only the CloudWatch Unified Agent fits that role.

How to eliminate wrong answers

Option A is wrong because SQS is a managed message queue service, not an agent — it does not run on a server to collect and forward logs. Option B is wrong because Kinesis Firehose is a managed delivery stream service that can route data to destinations like S3 or CloudWatch, but it is not an agent installed on an on-premises host to collect logs. Option D is wrong because AWS Config is a configuration compliance and inventory service, not a log-shipping agent.

Practice this question →
31
MCQmedium

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

A.keep-hostname(yes);
B.use-dns(yes);
C.dns-cache(yes);
D.chain-hostnames(yes);
AnswerB

The use-dns(yes) option in syslog-ng enables reverse DNS lookups on incoming log messages, replacing IP addresses with hostnames when possible. This directly addresses the scenario where devices do not send hostnames, allowing the centralized server to resolve them. It is a global option typically set in the syslog-ng.conf file under the options block.

Why this answer

To replace IP addresses with hostnames in syslog-ng, the use-dns(yes) option must be enabled. This triggers reverse DNS lookups on incoming messages, resolving IPs to hostnames when the sending device does not provide one. The other options either preserve existing hostnames, cache lookups, or handle relay chains, but none enable the necessary DNS resolution.

Exam trap

The trap here is confusing hostname preservation with hostname resolution, leading to selection of keep-hostname instead of use-dns.

Practice this question →
32
Multi-Selecthard

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)

Select 2 answers
A.DNS query logs
B.Web proxy logs
C.System performance logs
D.Firewall logs
E.Authentication logs
AnswersB, D

Web proxy logs capture HTTP/HTTPS requests, including URLs, user agents, and bytes sent/received. They are crucial for identifying data exfiltration via web protocols, such as uploads to cloud storage or file-sharing sites. The logs can show the volume of data transferred and the destination, directly addressing the scenario's need to determine method and volume. They complement firewall logs by providing application-layer details.

Why this answer

Firewall logs and web proxy logs are the most critical for determining data exfiltration method and volume. Firewall logs show outbound connections and byte counts, while proxy logs provide application-layer details like URLs and payload sizes. Together, they allow the analyst to identify the channel and quantify the data transferred.

Other logs like DNS or authentication may provide context but lack the direct volume and method information.

Exam trap

The trap here is overemphasizing logs that indicate intent or access, such as authentication or DNS, rather than focusing on logs that directly record data transfer volumes and destinations.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Log Management questions.

Start 20-question session