Cyber Defense · lesson 8 of 12 · 25 min

Log analysis lab

summary: A safe log review starts with a question: what account, system, or time period are you investigating? Compare events with normal behavior and record evidence before drawing conclusions.

question: What should you look for in repeated failed sign-ins?

options:

• A pattern that needs review
• A reason to delete all logs
• Proof of guilt by itself
• A new desktop theme

correct: A pattern that needs review

explanation: Repeated failures can be meaningful, but they need context and careful investigation.

---

Previous lesson: Why logs matter
Back to Cyber Defense
Next lesson: Intrusion detection concepts