Secure Auditing and Logging CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security architect is designing a logging solution for a high-security environment. The requirement is to ensure that logs cannot be altered by an attacker who gains root access to the application server. Which approach is most effective?

   • AUse a hardware security module (HSM) to sign each log entry with a private key, and verify signatures periodically.
   • BSend logs to a remote syslog server over the network using TLS.
   • CEncrypt the log file with a key stored in the application's configuration file.
   • DStore logs on the local disk and use file permissions to restrict access.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Java application logs user activity for security monitoring. The logs currently include the user's full name, email address, and IP address. A privacy impact assessment determines that this data is excessive. The security team must reduce the logging of personal data while still being able to investigate security incidents. Which approach is most appropriate?

   • AReplace the full name and email with a pseudonymous user ID and log only the IP address when necessary for incident response.
   • BContinue logging the full name and email because they are needed for investigations.
   • CEncrypt the logs so that the personal data is not readable.
   • DLog only the IP address and discard all other data.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which practice is most effective in preventing log injection when logging user-controlled data in a Java application?

   • AWriting user input to a separate log file that is not monitored.
   • BUsing a logging framework that automatically truncates all log messages to 100 characters.
   • CLogging user input in uppercase to normalize the data.
   • DEncoding user input to remove or escape control characters such as carriage return and line feed before logging.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is most appropriate to prevent exposure of sensitive data when logging a user's credit card number?

   • ALog the full credit card number but encrypt the entire log file.
   • BLog only the last four digits of the credit card number.
   • CLog the credit card number only when the user explicitly consents.
   • DLog the credit card number in base64 encoding.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team wants to detect brute-force attacks against a Java web application. They have access to application logs that record login attempts with username, timestamp, and success/failure status. Which monitoring and alerting strategy is most effective?

   • AAlert when the number of failed login attempts for a single username exceeds a threshold within a time window.
   • BAlert on every failed login attempt.
   • CAlert only when a successful login occurs after multiple failures.
   • DAlert when the total number of login attempts (successful and failed) exceeds a threshold.
   Reveal Solution Discussion Select an answer first