A company has hired a security administrator to maintain and administer Linux and Windows- based systems. Written in the nightly report file is the following:

Firewall log files are at the expected value of 4 MB.

The current time is 12am. Exactly two hours later the size has

decreased considerably.

Another hour goes by and the log files have shrunk in size again.

Which of the following actions should the security administrator take?

Question

A company has hired a security administrator to maintain and administer Linux and Windows- based systems. Written in the nightly report file is the following:

Firewall log files are at the expected value of 4 MB.
The current time is 12am. Exactly two hours later the size has

decreased considerably.

Another hour goes by and the log files have shrunk in size again.

Which of the following actions should the security administrator take?

Accepted Answer

D. Log the event as suspicious activity, continue to investigate, and act according to the site's Log files should only grow unless they are being cleared or rotated, and unexpected shrinkage at irregular intervals suggests an attacker may be covering their tracks by deleting log entries. The correct procedure is to document the anomaly, continue gathering evidence, and follow the site's incident response policy rather than escalating prematurely or taking unilateral action. Acting according to established site policy ensures proper chain of custody and appropriate escalation steps.

Answer

A. Log the event as suspicious activity and report this behavior to the incident response team Reporting immediately to the incident response team without further investigation may bypass the site's established policy and skip necessary evidence-gathering steps.

Answer

B. Log the event as suspicious activity, call a manager, and report this as soon as possible. Calling a manager immediately is premature - the site's incident response policy should dictate escalation paths, and acting outside that process can compromise the investigation.

Answer

C. Run an anti-virus scan because it is likely the system is infected by malware. Running an antivirus scan is not the appropriate first response to log file size anomalies, which more specifically suggest log tampering or deletion rather than malware infection.

A company has hired a security administrator to maintain and administer Linux and Windows- based systems. Written in the nightly report file is the following: - Firewall log files are at the expected

Question

Options

How the community answered

Why each option

Topics

Community Discussion