Secure Auditing and Logging CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which factor is most important to consider when determining how long to retain audit logs?

   • AThe personal preference of the system administrator.
   • BApplicable regulatory and compliance requirements that specify minimum retention periods.
   • CThe amount of disk space currently available on the server.
   • DThe number of users in the application.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Java application logs user profile updates. The profile includes fields such as email, phone number, and address. The security team is concerned about logging sensitive personal data. What is the best practice?

   • ALog the user ID and the timestamp of the update, but not the field names.
   • BLog the full profile data but encrypt the log file.
   • CLog only the fields that changed, without the actual values.
   • DLog the full profile data to ensure a complete audit trail.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which access control measure is appropriate for protecting the confidentiality of audit logs?

   • AStoring logs in the application's web root so they can be downloaded easily.
   • BMaking logs publicly accessible to comply with open-source principles.
   • CGranting all application users read access to logs for transparency.
   • DRestricting read and write access to authorized administrators only.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Java application logs search queries entered by users. An attacker submits the following query: "test\r\n[INFO] User 'admin' deleted all records". The application logs the query as-is. What is the most effective mitigation?

   • AEncode or strip carriage return and newline characters from the query before logging.
   • BRestrict the length of the query to 50 characters.
   • CUse a logging framework that writes to a database instead of a text file.
   • DLog the query in base64 encoding.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst notices that the application logs contain many entries with the message "NullPointerException" but no stack trace. The analyst wants to improve the logs to aid in incident response. What should be done?

   • ALog the exception class name only.
   • BConfigure the logging framework to include the full stack trace for all exceptions.
   • CLog only the exception message to reduce noise.
   • DDisable logging of exceptions to avoid clutter.
   Reveal Solution Discussion Select an answer first