Log analysis techniques in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Log Aggregation

What is the primary purpose of log aggregation in cybersecurity?

A To encrypt logs so only administrators can read them

B To delete old logs automatically to save storage space

C To collect logs from multiple sources into a single location for easier analysis

D To generate fake logs to confuse attackers

💡 Hint

Think about how managing logs from many devices can be simplified.

Log aggregation gathers logs from various devices and systems into one place. This makes it easier to search, analyze, and detect security issues.

📋 Factual

intermediate

Common Log Formats

Which of the following is a widely used standard format for web server logs?

A Common Log Format (CLF)

B JSON Log Format

C XML Log Format

D Binary Log Format

💡 Hint

It is a simple text format used by many web servers like Apache.

The Common Log Format (CLF) is a standardized text format used by web servers to record requests. It is easy to read and widely supported.

🚀 Application

advanced

Detecting Anomalies in Logs

You notice a sudden spike in failed login attempts in your system logs. What is the best immediate action to take?

A Ignore it as normal activity

B Investigate the source IP addresses and block suspicious ones

C Restart the server to clear the issue

D Delete the logs to prevent confusion

💡 Hint

Think about how to stop potential attacks quickly.

A spike in failed logins can indicate a brute force attack. Investigating and blocking suspicious IPs helps protect the system.

🔍 Analysis

advanced

Log Retention Policies

Why is it important to have a log retention policy in cybersecurity?

A To ensure logs are kept long enough for investigations but not indefinitely to save storage

B To delete all logs immediately after creation

C To keep logs only for a day regardless of importance

D To print logs daily for manual review

💡 Hint

Consider balancing investigation needs and storage limits.

Log retention policies define how long logs are stored. Keeping them long enough helps with investigations, but storing forever wastes resources.

❓ Reasoning

expert

Correlating Logs for Threat Detection

Which approach best helps in detecting complex attacks by analyzing logs?

A Analyzing logs from a single device only

B Ignoring timestamps in logs during analysis

C Deleting logs after one day to reduce noise

D Correlating logs from multiple sources to find patterns

💡 Hint

Think about how attackers might use multiple systems.

Correlating logs from different devices and systems helps detect attacks that span multiple points, revealing patterns not visible in single logs.