Logging and audit trails in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of syslog command filtering

What is the output of the following command on a Linux system with syslog configured?

sudo grep "ERROR" /var/log/syslog | tail -n 3

Assume the last three ERROR entries in syslog are:
1. "ERROR: Disk quota exceeded"
2. "ERROR: Failed to start service"
3. "ERROR: Network unreachable"

Cybersecurity

sudo grep "ERROR" /var/log/syslog | tail -n 3

A No output, command returns empty

B

ERROR: Network unreachable
ERROR: Failed to start service
ERROR: Disk quota exceeded

C

ERROR: Disk quota exceeded
ERROR: Network unreachable
ERROR: Failed to start service

D

ERROR: Disk quota exceeded
ERROR: Failed to start service
ERROR: Network unreachable

💡 Hint

The tail command shows the last lines in the order they appear.

The grep command filters lines containing 'ERROR' in syslog. Tail -n 3 shows the last three lines in the original order, so the output matches the last three ERROR entries as listed.

🧠 Conceptual

intermediate

Purpose of audit trails in security

Which of the following best describes the primary purpose of audit trails in cybersecurity?

A To automatically block unauthorized access attempts in real-time

B To encrypt data during transmission to prevent interception

C To record user activities and system events for accountability and forensic analysis

D To backup system files regularly to prevent data loss

💡 Hint

Think about what audit trails help you do after an event happens.

Audit trails provide a record of user and system actions. This helps in tracking what happened, who did it, and when, which is essential for accountability and forensic investigations.

❓ Troubleshoot

advanced

Troubleshooting missing log entries

A system administrator notices that some critical security events are missing from the audit log file. Which of the following is the most likely cause?

A The audit daemon configuration excludes those event types from logging

B The system clock is set to the wrong time zone

C The log file permissions are set to read-only for all users

D The disk space is sufficient and logs are rotating properly

💡 Hint

Consider what controls which events get logged.

Audit daemons use configuration files to specify which events to log. If critical events are missing, it is likely those event types are not included in the configuration.

🔀 Workflow

advanced

Steps to secure audit logs

Which sequence of steps correctly describes how to secure audit logs to prevent tampering?

A 2,1,4,3

B 1,2,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Think about setting up, protecting, forwarding, then verifying logs.

First configure where logs are stored, then restrict access, forward logs to a secure remote server to prevent local tampering, and finally verify integrity regularly.

✅ Best Practice

expert

Best practice for log retention policy

What is the best practice for defining a log retention policy in a secure environment?

A Retain logs only as long as needed to meet compliance and forensic requirements, then securely delete

B Keep all logs indefinitely to ensure no data is lost

C Archive logs without encryption to simplify access

D Delete logs daily to save disk space and improve performance

💡 Hint

Balance between compliance needs and storage management.

Logs should be kept long enough to satisfy legal, compliance, and forensic needs, then securely deleted to reduce risk and save resources.