CFA-001 practice question 22 of 25
Router log files provide detailed Information about the network traffic on the Internet. It gives information about the attacks to and from the networks. The router stores log files in the____________.
Full set: 180 questionsDomain Network Forensics
Routers store log files in an internal memory area known as a logging buffer. This buffer functions as a cache, temporarily holding system messages and traffic information in volatile memory (RAM). Due to the limited size and volatile nature of this on-device storage, the logs are typically configured to be sent to an external syslog server for long-term storage and analysis. In the context of the available options, "Router cache" is the most accurate description of this temporary, on-device log storage location.
B. Application logs: These logs are generated by end-user applications running on servers or workstations, not by the router's network operating system.
C. IDS logs: These are specialized logs created by an Intrusion Detection System (IDS), which is a separate function or device from a standard router.
D. Audit logs: This term describes a functional type of log used for security auditing, not the physical storage location within the router.
1. Cisco Systems, Inc., Cisco IOS XE Gibraltar 16.11.x (Catalyst 9800 Series Wireless Controllers) System Message Logging Configuration Guide. In the "Information About System Message Logging" section, it states, "By default, a device sends system logging (syslog) messages to the internal buffer... This internal buffer is also referred to as the logging buffer or RAM buffer." This confirms logs are stored in an internal buffer, which functions as a cache.
2. Richard III, G. G., & Marrington, A. (2012). A Survey of Router Forensics. In Systematic Approaches to Digital Forensic Engineering (pp. 249-273). IEEE. DOI: https://doi.org/10.1109/SADFE.2012.11. This paper discusses the challenges of router forensics, noting on page 252 that crucial evidence, including logs, is often stored in volatile memory (RAM) and can be lost when the device is powered down. This volatile storage is conceptually a cache.
3. University of California, Berkeley. EECS 122: Introduction to Communication Networks Course Notes. In lectures covering network management and monitoring, it is explained that network devices like routers have limited onboard storage and use memory buffers (caches) for temporary log storage before forwarding to a centralized logging server. This is a standard principle taught in networking curricula.
Keep practicing
Take the free CFA-001 practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CFA-001 practice questions
- Question 1Which of the following commands shows you the names of all open shared files on a server …
- Question 2Billy, a computer forensics expert, has recovered a large number of DBX files during fore…
- Question 3Hash injection attack allows attackers to inject a compromised hash into a local session …
- Question 4The Apache server saves diagnostic information and error messages that it encounters whil…
- Question 5First response to an incident may involve three different groups of people, and each will…
- Question 6The Recycle Bin exists as a metaphor for throwing files away, but it also allows user to …
