Describe an Effective Logging Strategy for an Application 350-901 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An operations team manages a high-traffic web application. They want to alert on 5xx errors. Currently, they have an alert that triggers when the count of ERROR logs exceeds 100 in 5 minutes. However, during a recent incident, the alert did not fire because the application logged many 5xx errors as WARN due to a misconfiguration. The team wants to ensure alerts are based on the actual HTTP status code, not the log level. Which approach should they use?

   • AModify the application to log the HTTP status code as a structured field, and create an alert that queries for 'status_code >= 500'.
   • BIncrease the alert threshold to 200 ERROR logs in 5 minutes to reduce false negatives.
   • CChange all WARN logs to ERROR so that the existing alert catches them.
   • DCreate a separate alert that triggers on any log containing the text '5xx'.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A healthcare application logs patient interactions. The development team wants to add structured logging to capture user actions for debugging. However, the logs currently include patient names, email addresses, and medical record numbers in plain text. What should the team do to comply with privacy regulations while maintaining useful logs?

   • AEncrypt the entire log file at rest and continue logging all fields, including patient names and medical record numbers.
   • BReplace direct identifiers with a pseudonymous patient ID that is only mapped to real identities in a secure, separate system.
   • CLog only the timestamp and the HTTP status code, omitting all user-related information.
   • DMask the email address partially (e.g., j***@example.com) but keep the full patient name and medical record number.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company runs its application on 20 virtual machines. The operations team currently SSHes into each VM to view logs. They want to set up a unified monitoring dashboard that shows errors across all VMs in real time. Which approach should they take?

   • AUse a single VM as the log collector and have all other VMs write logs to its local filesystem via NFS.
   • BCreate a script that periodically copies logs from each VM to a shared network drive.
   • CConfigure each VM to send logs directly to the operations team's email addresses.
   • DInstall a log agent on each VM that forwards logs to a central aggregation service, then build dashboards on that service.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A team is implementing structured logging in a Python application. They want to include a correlation ID and a user ID in every log entry. They are concerned about accidentally logging sensitive data like passwords or tokens. Which approach best addresses both requirements?

   • AManually add the correlation ID and user ID to every log statement, and rely on developers to avoid logging sensitive data.
   • BUse a global variable to store the correlation ID and user ID, and include them in log messages as plain text.
   • CUse a logging filter that adds the correlation ID and user ID to every record, and configure a redaction filter to mask sensitive fields before output.
   • DLog the entire request object, including headers and body, to capture all context, and encrypt the log file.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services company is required by regulation to retain audit logs for 7 years. Their application generates 50 GB of logs per day. They use a central log management platform that charges per GB per month for storage. They want to minimize cost while remaining compliant. Which strategy should they implement?

   • AStore logs in hot storage for 30 days, then move them to cold archival storage for the remaining 6 years and 11 months.
   • BKeep all logs in hot storage for the full 7 years to ensure instant access at any time.
   • CCompress logs and store them only in the application server's local disk for 7 years.
   • DDelete logs older than 30 days to reduce storage costs, and rely on backups of the application database for audits.
   Reveal Solution Discussion Select an answer first