Secure Auditing and Logging CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Java application logs authentication events. The development team wants to include the user's password in the log message to help debug a login issue. What is the best practice?

   • ALog the password only for failed login attempts to help identify the issue.
   • BLog the password hash instead of the plaintext password.
   • CLog a masked version of the password, such as the first two characters.
   • DDo not log the password; log only the username and the outcome of the authentication attempt.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which event pattern is most important to monitor for in authentication logs to detect a brute-force attack?

   • AA user logging in from a different device than usual.
   • BA single successful login from a known user.
   • CA low number of failed login attempts spread over several weeks.
   • DA high number of failed login attempts from the same source IP address within a short time period.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary goal of sanitizing user input before writing it to a log file?

   • ATo prevent log injection attacks where an attacker forges log entries or injects malicious content.
   • BTo ensure the log entries are encrypted before being written.
   • CTo ensure the log file is stored in a compressed format to save disk space.
   • DTo make the log entries more readable for human operators.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's audit logs are stored on a network share. The security team suspects that an attacker with administrative privileges may have modified or deleted log entries to cover their tracks. Which control would BEST detect such tampering?

   • ASet the log files to read-only using file system permissions.
   • BEncrypt the log files using a strong encryption algorithm.
   • CUse a cryptographic hash chain where each log entry contains the hash of the previous entry.
   • DStore logs in a database with a trigger that prevents updates.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is subject to multiple regulations with conflicting log retention requirements: Regulation A requires 1 year, Regulation B requires 5 years, and Regulation C requires 3 years. The security team must implement a retention policy that satisfies all regulations while minimizing storage costs. Which approach should they take?

   • ARetain logs indefinitely to be safe.
   • BRetain all logs for 5 years, the longest required period, and then securely delete them.
   • CRetain logs for 3 years and then delete them.
   • DRetain logs for 1 year and then delete them to minimize costs.
   Reveal Solution Discussion Select an answer first