Secure Auditing and Logging CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A Java application logs user input to a centralized log management system. The security team wants to prevent log injection while preserving the original input for debugging. Which approach best balances security and usability?

   • ASanitize the input by removing CR and LF characters, and log the sanitized version.
   • BLog the input in JSON format with proper escaping.
   • CLog the original input but escape CR and LF characters with a backslash (e.g., \n and \r).
   • DEncode the user input using Base64 before logging.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations team is overwhelmed by alerts from their SIEM. They want to reduce false positives while ensuring that real security incidents are not missed. The application logs include authentication events, input validation errors, and business logic exceptions. Which strategy is most effective?

   • AIncrease the alert threshold for all event types to reduce noise.
   • BCreate a baseline of normal behavior and alert only on deviations from the baseline.
   • CDisable alerts for input validation errors because they are not security relevant.
   • DAlert only on critical severity logs, such as authentication failures.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is subject to GDPR and must comply with the right to erasure. They store audit logs that contain personal data of users. What is the best approach to handle logs when a user requests deletion of their data?

   • ADelete the entire log file that contains the user's data.
   • BAnonymize or pseudonymize the user's personal data in the logs while retaining the log entries for security purposes.
   • CIgnore the request because logs are exempt from GDPR.
   • DRetain the logs unchanged and inform the user that deletion is not possible.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A multinational company must comply with GDPR, which requires that personal data not be kept longer than necessary. The company's audit logs contain IP addresses and usernames. The security team is designing a retention policy. Which approach best balances compliance and operational needs?

   • ARetain logs indefinitely to ensure availability for any future legal request.
   • BRetain logs only for 30 days and then delete them without any exception.
   • CRetain logs for a defined period based on the purpose, then anonymize or securely delete them.
   • DRetain logs for 10 years regardless of purpose to be safe.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Java application logs user actions to a text file. A user enters the following as a username: "admin\n[ERROR] User logged in". The log entry is written as: "User 'admin\n[ERROR] User logged in' logged in". What is the primary security concern and what should be done?

   • AThe username contains a newline character that could allow log injection; sanitize the input by removing or encoding newlines and other control characters.
   • BThe application should use a different logging framework that automatically escapes special characters.
   • CThe log file should be encrypted to prevent an attacker from reading the injected content.
   • DThe username is too long; truncate it to a fixed length before logging.
   Reveal Solution Discussion Select an answer first