312-39 · Question #23
A large web hosting service provider, Web4Everyone, hosts multiple major websites and platforms. You are a Level 1 SOC analyst responsible for investigating web server logs for potential malicious…
The correct answer is D. Extended Log Format (ELF). Extended Log Format (commonly used as “Combined” or “Extended” variants in web logging) is designed to include additional fields beyond the Common Log Format baseline, such as referrer and user-agent-both critical for SOC investigations of web attacks. CLF typically captures…
Question
A large web hosting service provider, Web4Everyone, hosts multiple major websites and platforms. You are a Level 1 SOC analyst responsible for investigating web server logs for potential malicious activity. Recently, your team detected multiple failed login attempts and unusual traffic patterns targeting the company’s web application. To efficiently analyze the logs and identify key details such as remote host, username, timestamp, requested resource, HTTP status code, and user-agent, you need a structured log format that ensures quick and accurate parsing. Which standardized log format will you choose for this scenario?
Options
- AJSON Format
- BCommon Log Format (CLF)
- CTab-Separated Format
- DExtended Log Format (ELF)
How the community answered
(31 responses)- A3% (1)
- B6% (2)
- C3% (1)
- D87% (27)
Explanation
Extended Log Format (commonly used as “Combined” or “Extended” variants in web logging) is designed to include additional fields beyond the Common Log Format baseline, such as referrer and user-agent-both critical for SOC investigations of web attacks. CLF typically captures remote host, identity/user (if available), timestamp, request line, status code, and bytes sent, but it does not reliably include user-agent by default. The scenario explicitly requires user-agent and fast parsing across common web fields, which is exactly what extended formats provide: richer context in a predictable structure without needing custom parsing rules for every environment. JSON is highly flexible and can be excellent for structured logging, but it is not the classic “standardized web server log format” typically referenced when discussing remote host, request, status, and user-agent in a single line structure. Tab-separated is a delimiter style, not a standard web server format. From a SOC perspective, having user-agent and related HTTP metadata is essential for identifying automated tooling, bot patterns, scanner signatures, and suspicious client behaviors, and extended web log formats enable faster triage and correlation in SIEM and log analytics tools.
Topics
Community Discussion
No community discussion yet for this question.