Log Data — Quiz

1. A security analyst notices that employees are using BitTorrent over port 443 to bypass firewall rules that block the standard BitTorrent port. Which firewall capability would detect and block this traffic, and what does it examine that traditional firewalls do not?

A. URL filtering — blocks by destination domain name regardless of port B. Next-generation firewall application identification — identifies the actual application generating traffic regardless of port, detecting BitTorrent even when using port 443 C. IPS signatures — detects BitTorrent by matching known attack patterns in the traffic D. VPN split tunneling detection — identifies traffic that bypasses corporate controls

2. An analyst investigating a phishing incident examines email metadata and finds that the message display name shows "CEO@company.com" but the email headers show the message was relayed through a server in a foreign country with a failed DMARC check. What does this metadata reveal?

A. The CEO's account was compromised and the attacker sent the message from abroad B. The email is a spoofing attempt — the display name is forged; the actual origin (relay server and failed DMARC) reveals the email did not come from the legitimate CEO account C. The CEO was traveling internationally and sent the message from a foreign server D. The company's email server is misconfigured and DMARC is producing false positives

3. A SIEM correlation rule fires an alert: "Account logged in successfully from the US at 14:00 UTC and from China at 14:08 UTC." No VPN or shared account is involved. What is this type of detection called, and what does it indicate?

A. Time-based alert — the account exceeded the maximum daily login count threshold B. Impossible travel detection — the physical distance between two authenticated login locations cannot be covered in the elapsed time, indicating credential compromise or account sharing C. Brute force detection — multiple failed authentication attempts preceded the successful logins D. Geofencing violation — the company blocks all logins from China at the firewall

4. A security operations center needs to review failed VPN authentication attempts over the past 90 days for a forensic investigation. Which tool provides this historical analysis capability, and why are dashboards insufficient for this task?

A. A packet capture tool, because only full packet analysis can show authentication failures B. The SIEM, because it stores historical log data with retention capability for forensic review; dashboards show current/recent state only and are not designed for 90-day historical analysis C. A dashboard, because dashboards aggregate all log data including historical events D. Vulnerability scan data, because authentication failures are classified as vulnerabilities

5. During an incident investigation, an analyst needs to determine the exact protocol used by malware to communicate with its command-and-control server, including the complete content of each packet. Which log source provides this level of detail?

A. Firewall logs — they record source, destination, and port for all connections B. SIEM correlation — it identifies the C2 pattern from correlating IPS and firewall logs C. Packet captures (pcap files analyzed with Wireshark) — the only source that captures the complete payload content of each packet D. NetFlow/IPFIX metadata — it provides protocol and byte count per flow

6. An IPS alert fires for a buffer overflow exploit attempt targeting a specific vulnerability (CVE-XXXX) on a web server. The vulnerability scanner data in the SIEM shows that the targeted server was patched for CVE-XXXX last week. How does this correlation affect incident priority?

A. Priority is unchanged — any IPS alert for a buffer overflow is always critical regardless of patch status B. Priority is reduced — if the target is already patched, the exploit attempt is unlikely to succeed; the alert should still be investigated but is lower urgency than if the server were vulnerable C. Priority is eliminated — the SIEM should suppress all IPS alerts for CVE-XXXX once the patch is confirmed D. Priority is elevated — an attacker targeting a patched server indicates advanced capabilities

Matching: Log Sources and Their Primary Value

Match each log source (1–4) to its primary security value (A–D).

1VPN concentrator logs

2File metadata

3OS security logs

4Wireless access point logs

AReveals author name, creation/modification dates, and revision history that may persist in documents even after sanitization attempts

BProvides detailed authentication events, account lockouts, privilege escalation, and audit log clearing events; extremely verbose and requires filtering before SIEM forwarding

CRecords user authentication, tunnel establishment/teardown, source IP addresses, and per-session data volumes; useful for detecting credential stuffing and large data transfers over VPN

DCaptures client associations, authentication events, and channel changes; used to detect rogue clients, de-authentication attacks, and evil twin access points