Unit 2: Log and Network Traffic Analysis - Practice Quiz

1 What is the primary security role of log and event analysis?

2 Which technique links related events from multiple logs?

3 In log analysis, what is an anomaly?

4 Why are logs from several systems often sent to a central platform?

5 Which control best helps detect unauthorized changes to stored logs?

6 What information is most useful for arranging attack events in the order they occurred?

7 How can an API support advanced threat detection?

8 What is a main challenge of analyzing logs from different operating systems?

9 Which cloud log pattern may indicate cryptojacking?

10 Which platform commonly integrates and analyzes logs from many security sources?

11 Which measure helps evaluate how well a log analysis system detects real threats?

12 What does traffic normalization do before network data is analyzed?

13 How does threat intelligence improve network traffic analysis?

14 What does contextual protocol analysis examine?

15 What is the main difference between a NIDS and a NIPS?

16 Why is vulnerability validation performed after a scanner reports a weakness?

17 In network analysis, what is a jarring signal?

18 What is the purpose of modelling normal protocol behavior?

19 Which event is most likely to be flagged as an authentication anomaly?

20 Where is a network intrusion detection system commonly placed?

21 A user account successfully signs in from two distant countries within 15 minutes. Which use of log and event analysis best helps identify this incident?

22 An analyst must find a coordinated attack distributed across millions of DNS, proxy, and endpoint events. Which technique is most appropriate?

23 A database server normally produces 20 to 40 failed logins per hour. It suddenly records 600 failed logins from one source in an hour. Which detection method best identifies this activity?

24 A SIEM receives firewall logs in UTC and application logs in local time. Correlation rules frequently place related events in the wrong order. What should be done first?

25 An organization needs evidence that archived audit logs have not been modified after collection. Which control most directly provides this assurance?

26 Logs show a phishing attachment opening at 09:10, a PowerShell process starting at 09:12, and an outbound connection beginning at 09:13. What is the best next step when reconstructing the attack chain?

27 A detection service must enrich newly observed file hashes by querying a threat-intelligence API. Which design best reduces unnecessary API requests?

28 Windows records a username as DOMAIN\\alex, while a Linux application records the same person as alex@example.com. What enables reliable cross-platform correlation?

29 A cloud workload shows sustained 95% CPU usage, newly created compute instances, and outbound connections to known mining pools. Which conclusion is best supported?

30 A security team wants a high-confidence alert when a disabled employee account authenticates to a sensitive application. Which integration is most useful?

31 During validation, a detection rule generates 120 alerts. Investigation confirms that 30 alerts represent real attacks. What is the rule's precision?

32 An analyst compares HTTP activity captured on internal, guest, and server network segments. Before applying one detection rule to all captures, what is most important?

33 A threat feed lists an IP address as malicious, but the address was last observed two years ago and now belongs to a large hosting provider. How should the indicator be used?

34 A workstation sends an HTTP POST request containing a large encoded payload to a domain it has never contacted before. Which additional context would most improve analysis?

35 A company must stop a known exploit before it reaches a public web server, but it also wants to avoid blocking unrelated traffic. Which deployment is most appropriate?

36 A scanner reports that an internal server is vulnerable to an obsolete TLS cipher. Which traffic evidence best validates that the weakness is actually being used?

37 A network sensor observes a finance workstation making periodic DNS queries with unusually long, high-entropy subdomain labels. Why is this a jarring signal?

38 A model of normal SMB behavior shows that employee workstations contact two file servers during business hours. A workstation begins initiating SMB sessions with 80 peers overnight. What should the model flag?

39 A service account normally accesses one database from a fixed application server. It begins accessing several file shares from an employee laptop. Which feature combination is most useful for anomaly detection?

40 After placing a new NIPS inline, legitimate application requests are blocked because they resemble an attack signature. What is the best immediate corrective action?

41 A forensic team correlates authentication, endpoint, and firewall logs after a breach. The systems use unsynchronized clocks, with observed offsets ranging from -4 to +7 minutes. Which approach best supports a defensible reconstruction of event causality?

42 An enterprise has millions of common PowerShell events and a small number of legitimate administrative scripts. Which analytic is most likely to identify malicious PowerShell without relying only on known command signatures?

43 A cloud backup service produces high outbound traffic every Sunday night and during irregular disaster-recovery tests. A static threshold generates repeated false positives. Which model is most appropriate?

44 A SIEM receives Windows, Linux, SaaS, and network logs whose fields represent identities differently. Which ingestion design best preserves forensic value while enabling reliable correlation?

45 Administrators of a compromised host may modify both local logs and the log-forwarding agent. Which control most strongly supports later detection of selective log deletion or alteration?

46 Logs show a malicious document, a scripting-engine launch, credential access, and remote service creation. Several users opened identical documents. Which evidence most reliably links these events into one attack chain?

47 A detection service polls an endpoint telemetry API that uses pagination and eventually consistent indexing. Events may appear late or be returned twice. Which collection strategy best prevents missed detections and duplicate processing?

48 The same employee appears as CORP\\jlee in Windows logs, jlee@example.com in SaaS audit logs, and an immutable UUID in an identity provider. How should a cross-platform analytic correlate this activity?

49 A Kubernetes cluster shows sustained CPU saturation, but network flow logs reveal only approved registries and internal services. Which additional evidence most strongly distinguishes cryptojacking from legitimate batch computation?

50 A high-confidence SIEM rule automatically disables user accounts through a SOAR platform. During testing, duplicated alerts trigger repeated disable and enable actions. Which integration property should be added first?

51 Two detectors are tested against a highly imbalanced dataset containing 100 attacks and 99,900 benign sessions. Detector X has 99.5% accuracy but catches 20 attacks; Detector Y has 98.5% accuracy and catches 90 attacks. Which evaluation is most appropriate?

52 Sensors on both sides of a load balancer observe overlapping traffic, while asymmetric routing causes some sensors to see only one direction. Which pipeline best prepares the traffic for behavioral analysis?

53 A threat feed marks an IP address as command-and-control infrastructure, but the address belongs to a large cloud provider and changes tenants frequently. What is the best way to operationalize this indicator?

54 A DNS response contains a low-TTL TXT record with a large encoded payload. Similar records are used legitimately for email authentication. Which analysis most reliably identifies possible DNS tunneling?

55 An attacker sends overlapping IP fragments that an endpoint and an inline NIPS may reassemble differently. Which defensive behavior most directly addresses this evasion technique?

56 A scanner reports a critical web-server vulnerability on a public virtual IP. Packet analysis shows requests are terminated by a reverse proxy before reaching one of several backends. What evidence best validates actual exploitability?

57 A workstation normally communicates with SaaS services through an authenticated proxy. It suddenly begins sending periodic direct TLS connections to a newly registered domain, but each flow is small. Which feature combination makes this signal most concerning?

58 A detector must identify misuse of an industrial protocol in which each command is legal individually, but commands become dangerous when issued in the wrong operational phase. Which model is best suited to this requirement?

59 A sequence rule searches for login failure, login success, privilege escalation, and data access within ten minutes. Because events arrive late, the SIEM sometimes correlates unrelated sessions or misses valid chains. Which redesign best addresses both problems?

60 An inline NIPS protects a latency-sensitive payment service. A new rule detects a serious exploit but has an uncertain false-positive rate. Which deployment sequence best balances protection and availability?