nerdexam
EC-Council

312-39 · Question #99

312-39 Question #99: Real Exam Question with Answer & Explanation

The correct answer is A. Transaction log. The SQL Server transaction log records changes made to the database, including data modifications (INSERT/UPDATE/DELETE) and many schema-related operations, supporting reconstruction of what changed and when. For unauthorized modifications, the transaction log provides the strong

Question

Pearl is a Level 1 SOC analyst at a global financial institution using SQL Server to store sensitive customer information. She investigates an alert showing multiple failed web app logins from the same IP, followed by a successful login as a server administrator. She then reviews SQL Server logs and finds the attacker used compromised credentials to access the SQL Server database. Which log will help identify whether the intruder performed unauthorized modifications in the database?

Options

  • ATransaction log
  • BSecurity log
  • CMaintenance log
  • DAudit log

Explanation

The SQL Server transaction log records changes made to the database, including data modifications (INSERT/UPDATE/DELETE) and many schema-related operations, supporting reconstruction of what changed and when. For unauthorized modifications, the transaction log provides the strongest evidence trail because it is tied to the database engine’s durability mechanism and captures the sequence of committed actions. In SOC investigations, transaction log analysis helps determine whether data was altered, which tables were impacted, and the time window of changes. Security logs or SQL Server security-related events help with authentication/authorization and may show login activity, but they do not reliably enumerate every data modification. Maintenance logs relate to scheduled maintenance tasks (backups, index rebuilds) and are not designed to capture unauthorized content changes. Audit logs can be extremely useful if SQL Server auditing is configured to capture specific actions and statements, but the question asks which log helps identify whether modifications occurred; the transaction log is the baseline record of actual database changes. In practice, SOC teams correlate transaction log evidence with authentication logs, application logs, and potentially SQL auditing to attribute actions to accounts and sessions, then scope and remediate.

Community Discussion

No community discussion yet for this question.

Full 312-39 Practice