MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. 1. What is the primary purpose of traffic logs in network monitoring?
         a. To store user passwords
         b. To track and record network activities
         c. To generate encryption keys
         d. To speed up data transfer
         Answer: b. To track and record network activitiesscribd+1
2. Which tool is most widely used for capturing and analyzing network traffic logs?
   a. Photoshop
   b. AutoCAD
   c. Wireshark
   d. MS Excel
   Answer: c. Wiresharkitexamanswers+2
3. What type of data is NOT typically found in traffic logs?
   a. Source IP addresses
   b. Destination ports
   c. User phone numbers
   d. Timestamps
   Answer: c. User phone numbersscribd+1
4. Which of these is a key benefit of analyzing traffic logs?
   a. Data encryption
   b. Identifying unauthorized access
   c. Compressing files
   d. Faster application launches
   Answer: b. Identifying unauthorized accessexamradar+1
5. What does the term ‘packet capture’ mean in network traffic logging?
   a. Deleting network data
   b. Storing packets offline
   c. Recording network packets for analysis
   d. Encrypting packets
   Answer: c. Recording network packets for analysistestbook+1
6. Which protocol analyzer can display packet details in real-time along with log export options?
   a. Notepad++
   b. Wireshark
   c. GIMP
   d. VLC Media Player
   Answer: b. Wiresharktestbook+1
7. What key information does a firewall typically log?
   a. Blocked/allowed connection attempts
   b. User browser history
   c. Printer logs
   d. Battery status
   Answer: a. Blocked/allowed connection attemptsitexamanswers+1
8. Which log retention policy is best practice for sensitive network environments?
   a. No retention
   b. Retain logs as long as legally required
   c. Retain for one hour
   d. Delete logs daily
   Answer: b. Retain logs as long as legally requiredrazorops+1
9. What is the function of log normalization in SIEM systems?
   a. Encrypting log files
   b. Converting logs into a common format
   c. Deleting duplicate logs
   d. Generating random logs
   Answer: b. Converting logs into a common formatitexamanswers
10. Which tool gathers network traffic metadata for flow analysis, such as peak usage and routing details?
    a. Excel
    b. NetFlow
    c. Paint
    d. Notepad
    Answer: b. NetFlowitexamanswers
11. In network logs, what type of data reveals which services are accessed by which hosts?
    a. Environmental data
    b. Session data
    c. Logon data
    d. Configuration data
    Answer: b. Session datascribd+1
12. What log entry is critical for investigating lateral movement in a network breach?
    a. Printer status changes
    b. Unusual SMB traffic
    c. User name spelling errors
    d. Battery drain logs
    Answer: b. Unusual SMB trafficscribd
13. Which of the following is a common log file location in Linux for network activity?
    a. /logs/network.txt
    b. /var/log/syslog
    c. /home/user/netlog
    d. /mnt/network_log
    Answer: b. /var/log/syslogscribd
14. What is log aggregation?
    a. Splitting logs into parts
    b. Consolidating similar log entries
    c. Deleting all logs
    d. Encrypting logs
    Answer: b. Consolidating similar log entriesrazorops+1
15. Which log type captures DNS queries and responses?
    a. Authentication logs
    b. DNS logs
    c. Firewall logs
    d. System logs
    Answer: b. DNS logsscribd
16. Which of these is NOT a best practice for traffic log retention?
    a. Storing logs on encrypted servers
    b. Disabling retention without review
    c. Regularly reviewing retention policies
    d. Archiving logs for compliance
    Answer: b. Disabling retention without reviewrazorops+1
17. Which format is preferred for storing network logs for machine processing?
    a. PDF
    b. XML
    c. BMP
    d. JPEG
    Answer: b. XMLrazorops+1
18. Which SIEM function links events from different network devices to speed detection?
    a. Aggregation
    b. Normalization
    c. Correlation
    d. Splitting
    Answer: c. Correlationitexamanswers
19. What is ‘statistical data’ in the context of network monitoring logs?
    a. Raw packet data
    b. Data produced by analysis of event logs
    c. User passwords
    d. Webcam images
    Answer: b. Data produced by analysis of event logsitexamanswers
20. Which utility can extract files from packet logs for forensic analysis?
    a. Notepad
    b. NetworkMiner
    c. Excel
    d. VLC Player
    Answer: b. NetworkMinerscribd
21. Which of these is a common use of traffic logs in compliance audits?
    a. Measuring internet speed
    b. Verifying data access events
    c. Drawing network diagrams
    d. Formatting hard drives
    Answer: b. Verifying data access eventsrazorops+1
22. What does log rotation accomplish in a busy network environment?
    a. Duplicates logs
    b. Archives and removes old logs to save space
    c. Encrypts all logs
    d. Forwards logs to the cloud
    Answer: b. Archives and removes old logs to save spacerazorops
23. Which of the following describes log tampering?
    a. Compressing log files
    b. Unauthorized modification or deletion of logs
    c. Archiving logs regularly
    d. Viewing logs in read-only mode
    Answer: b. Unauthorized modification or deletion of logs[10 ]scribd
24. What does a spike in log entries usually indicate?
    a. Normal operation
    b. Unusual or suspicious activity
    c. Low network usage
    d. Disk failure
    Answer: b. Unusual or suspicious activityscribd+1
25. For SIEM systems, what is the main advantage of log normalization?
    a. Generating duplicate logs
    b. Making logs searchable and comparable
    c. Decreasing log retention time
    d. Disabling log collection
    Answer: b. Making logs searchable and comparableitexamanswers
26. Where are Windows event logs typically stored?
    a. /var/log
    b. %SystemRoot%\System32\winevt\Logs
    c. /logfiles
    d. Documents folder
    Answer: b. %SystemRoot%\System32\winevt\Logsscribd+1
27. Which event is NOT likely to be found in traffic logs?
    a. Firewall rule matches
    b. Physical device temperature
    c. Denied connection requests
    d. Domain lookups
    Answer: b. Physical device temperatureitexamanswers+1
28. What is the primary risk of not regularly reviewing traffic logs?
    a. Improved network speed
    b. Missing early signs of malicious activity
    c. Lower storage requirements
    d. Fewer log files
    Answer: b. Missing early signs of malicious activityrazorops+1
29. What log level typically records detailed debug information?
    a. INFO
    b. ERROR
    c. DEBUG
    d. WARN
    Answer: c. DEBUGrazorops
30. What action can be taken if traffic logs reveal repeated failed login attempts?
    a. Ignore them
    b. Investigate for possible brute-force attack
    c. Delete relevant users
    d. Encrypt all logs
    Answer: b. Investigate for possible brute-force attackexamradar+1
31. Which forensic tool is used to analyze Windows event logs?
    a. Wireshark
    b. GIMP
    c. Event Viewer
    d. Ettercap
    Answer: c. Event Viewerscribd
32. What is a ‘log alert’ in network monitoring?
    a. A notification triggered by pre-defined log conditions
    b. A log containing images
    c. An automatic log backup
    d. An encrypted log file
    Answer: a. A notification triggered by pre-defined log conditionsitexamanswers+1
33. In log analysis, what is anomaly detection focused on?
    a. Filtering logs for size
    b. Identifying unusual patterns or deviations
    c. Coloring log files
    d. Renaming log files
    Answer: b. Identifying unusual patterns or deviationsrazorops
34. Which of the following is a way to prevent log modification by attackers?
    a. Store logs on the compromised system
    b. Use remote, tamper-evident log storage
    c. Delete logs daily
    d. Leave logs unmonitored
    Answer: b. Use remote, tamper-evident log storagerazorops
35. Which of these can be an indicator of a DDoS attack in traffic logs?
    a. Sudden, massive spike in traffic from many IPs
    b. System log update
    c. User password change
    d. Print job completion
    Answer: a. Sudden, massive spike in traffic from many IPsscribd+1
36. Which log file records events relating to access and activity of web servers?
    a. Authentication logs
    b. Access logs
    c. System logs
    d. DNS logs
    Answer: b. Access logsscribd
37. Which standard Linux command displays the last lines of a log file?
    a. head
    b. tail
    c. print
    d. cat
    Answer: b. tailscribd
38. What kind of log data does NetFlow collect?
    a. Packet payloads and graphics
    b. Flow-level metadata like source/destination, bytes, and duration
    c. Email attachments
    d. File contents
    Answer: b. Flow-level metadata like source/destination, bytes, and durationitexamanswers
39. Which user role should have access to modify network traffic logs?
    a. All users
    b. Only authorized administrators
    c. Guest users
    d. External contractors
    Answer: b. Only authorized administratorsrazorops+1
40. What is the danger of log overflow?
    a. Network logs become encrypted
    b. New log entries overwrite older, potentially critical data
    c. Enhanced alerting accuracy
    d. Less data collection
    Answer: b. New log entries overwrite older, potentially critical datarazorops
41. What do traffic logs reveal about insider threats?
    a. Network health
    b. Unusual access or movement within the network by insiders
    c. Device warranty status
    d. Backup job status
    Answer: b. Unusual access or movement within the network by insidersscribd+1
42. What field in traffic logs indicates the protocol used for communication?
    a. Status code
    b. Protocol field (e.g., TCP, UDP, ICMP)
    c. Font field
    d. Disk ID
    Answer: b. Protocol field (e.g., TCP, UDP, ICMP)itexamanswers+1
43. Which of these log analysis actions relies on timestamps?
    a. Session correlation and sequence reconstruction
    b. Color-coding log entries
    c. Encrypting logs
    d. Merging files
    Answer: a. Session correlation and sequence reconstructionscribd+1
44. What is the function of log-level filtering?
    a. Keeps all logs regardless of priority
    b. Selects logs to view or store based on severity
    c. Deletes all logs weekly
    d. Resets network devices
    Answer: b. Selects logs to view or store based on severityrazorops
45. What does a ‘denied connection’ entry in a firewall log signify?
    a. Successful access
    b. Blocked packet or request
    c. Encryption succeeded
    d. No activity detected
    Answer: b. Blocked packet or requestscribd+1
46. What is the advantage of storing logs in a central log management system?
    a. More manual effort
    b. Easier searching, correlation, and retention
    c. Lower compliance
    d. Lower reliability
    Answer: b. Easier searching, correlation, and retentionscribd+1
47. What describes synthetic monitoring (with logs)?
    a. User-initiated logging
    b. Automated transactions generating logs to test systems
    c. Random log selection
    d. Frequent log deletion
    Answer: b. Automated transactions generating logs to test systemsrazorops
48. Which approach best detects suspicious outbound data transfers in logs?
    a. Ignore outgoing connections
    b. Monitor and analyze egress (outbound) traffic logs
    c. Focus only on inbound
    d. Check for log compression
    Answer: b. Monitor and analyze egress (outbound) traffic logsscribd+1
49. What is ‘log parsing’?
    a. Encrypting log contents
    b. Decoding log entries into structured fields for analysis
    c. Deleting old entries
    d. Sending logs over the internet
    Answer: b. Decoding log entries into structured fields for analysisscribd+1
50. Which logging strategy reduces the risk of single-point log loss?
    a. Store all logs on one device only
    b. Centralize logs from multiple locations to a secure server
    c. Disable logging at certain times
    d. Stop log rotation
    Answer: b. Centralize logs from multiple locations to a secure serverscribd+1

1. https://www.scribd.com/document/867200742/Network-Log-Analysis-MCQ
2. https://itexamanswers.net/modules-24-25-protocols-and-log-files-group-exam-answers.html
3. https://testbook.com/question-answer/which-of-the-following-network-traffic-tool-can-ca–68a985fcc4ec26f595b732d2
4. https://examradar.com/logging-and-monitoring-information-disclosure-mcqs/
5. https://razorops.com/blog/top-50-monitoring-and-logging-interview-question-and-answers/
6. https://www.scribd.com/document/769479740/Advanced-Log-Analysis-Questions-And-Answers
7. https://www.sanfoundry.com/computer-network-questions-answers/
8. https://www.uninets.com/blog/computer-networks-mcq
9. https://testbook.com/objective-questions/mcq-on-networking–5eea6a1639140f30f369f551
10. https://www.sanfoundry.com/1000-traffic-engineering-questions-answers/
11. https://jco.simcc.org/topic/network-traffic-logs/
12. https://itexamanswers.net/23-2-1-packet-tracer-logging-network-activity-answers.html
13. https://www.placementpreparation.io/mcq/computer-network/
14. https://www.examtopics.com/discussions/palo-alto-networks/view/46715-exam-pcnse-topic-1-question-8-discussion/
15. https://testbook.com/objective-questions/mcq-on-traffic-engineering–5eea6a0839140f30f369d702
16. https://www.yeahhub.com/top-20-frequently-asked-network-security-mcqs-with-answers/
17. https://testbook.com/question-answer/which-of-the-following-network-traffic-tool-can-ca–68a985fcc4ec26f595b732d2/amp
18. https://www.sanfoundry.com/computer-networks-mcqs-network-attacks/
19. https://www.scribd.com/document/243090125/Network-Traffic-Analysis-Midterm-Exam
20. https://bcetodisha.ac.in/elearning/content/mca_uploads/2nd/Computer-Network-MCQ.pdf