nerdexam
EC-Council

212-82 · Question #117

NexaCorp. an enterprise with a robust Linux infrastructure, has been facing consistent downtimes without any apparent reasons. The company's initial investigation suggests possible unauthorized…

The correct answer is C. Implement a SIEM system that centralizes, correlates, and analyzes logs in real-time. To efficiently monitor and analyze Linux system logs for unauthorized changes, especially across a robust infrastructure, NexaCorp should implement a SIEM system.

Submitted by akirajp· Mar 6, 2026Cloud Security Operations & Incident Response

Question

NexaCorp. an enterprise with a robust Linux infrastructure, has been facing consistent downtimes without any apparent reasons. The company's initial investigation suggests possible unauthorized system-level changes. NexaCorp's IT team realizes that It needs to monitor and analyze system logs more efficiently to pinpoint the cause. What would be the optimal approach for NexaCorp to monitor and analyze its Linux system logs to detect and prevent unauthorized changes?

Options

  • AMonitor and analyze the /var/)og/syslog file daily for any unusual activities.
  • BSet up an automated script to send alerts if the last' command shows unexpected users.
  • CImplement a SIEM system that centralizes, correlates, and analyzes logs in real-time.
  • DOnly focus on monitoring SSH logs since most changes likely come through remote access.

How the community answered

(49 responses)
  • A
    18% (9)
  • B
    4% (2)
  • C
    71% (35)
  • D
    6% (3)

Why each option

To efficiently monitor and analyze Linux system logs for unauthorized changes, especially across a robust infrastructure, NexaCorp should implement a SIEM system.

AMonitor and analyze the /var/)og/syslog file daily for any unusual activities.

Manually monitoring a single log file daily is a reactive and inefficient approach for a robust infrastructure, making it difficult to detect subtle or widespread unauthorized changes in real-time.

BSet up an automated script to send alerts if the last' command shows unexpected users.

While 'last' command output can show user logins, it's a very limited scope for detecting unauthorized system-level changes and doesn't provide the comprehensive log analysis needed for detailed incident detection.

CImplement a SIEM system that centralizes, correlates, and analyzes logs in real-time.Correct

A Security Information and Event Management (SIEM) system is designed to aggregate log data from various sources, including Linux systems, in real-time. It then correlates these events to identify patterns indicative of unauthorized system-level changes or other security incidents, providing comprehensive and centralized visibility.

DOnly focus on monitoring SSH logs since most changes likely come through remote access.

Focusing only on SSH logs ignores other potential attack vectors and methods for making unauthorized system changes, such as local access, kernel exploits, or other network services.

Concept tested: Real-time log management and security event correlation

Source: https://learn.microsoft.com/en-us/azure/sentinel/overview

Topics

#log management#SIEM#real-time monitoring#incident detection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 212-82 Practice