Secure Auditing and Logging CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A Java application processes personal data and must comply with GDPR. The security team wants to implement audit logging for data access. However, the logs themselves contain personal data (e.g., user IDs and IP addresses). The DPO requires that logs be kept only as long as necessary. The security team also needs logs for incident investigation. Which approach best balances these requirements?

   • ARetain logs for a defined period (e.g., 90 days) and then automatically anonymize the personal data in the logs.
   • BDelete logs after 30 days regardless of any ongoing investigation.
   • CEncrypt logs and store them for 10 years to ensure availability.
   • DRetain logs indefinitely but restrict access to only the DPO.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Java application generates logs that are sent to a centralized SIEM. The security team wants to detect a potential data exfiltration attempt where an attacker downloads a large number of records. Which log data would be MOST useful for this detection?

   • ALog the HTTP status code for each request.
   • BLog the full content of every record accessed.
   • CLog the user ID, timestamp, and the number of records accessed in each request.
   • DLog only the IP address of the user.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Java application logs error messages that include user-supplied input. An attacker submits the following input: "Invalid input: %0d%0a[ERROR] User 'admin' deleted all records". The application logs the decoded input. What is the best mitigation?

   • AEncode the user input using HTML encoding before logging.
   • BLog the input in URL-encoded form.
   • CUse a logging framework that automatically truncates long messages.
   • DSanitize the input by removing or encoding CR and LF characters before logging.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Java application logs search queries entered by users. An attacker submits a query containing '\r\n[INFO] User admin logged in' to create a fake log entry. The security team wants to prevent this without losing the ability to log search queries. Which approach is most effective?

   • AEscape or remove carriage return and newline characters from the query before logging.
   • BBlock any query that contains the word 'admin'.
   • CUse a logging library that automatically encrypts log entries.
   • DLog the query in a separate file that is not monitored.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Java application logs user session data, including the session ID and the user's IP address. The security team wants to reduce the risk of session hijacking if logs are compromised. What is the best practice?

   • ALog the full session ID to enable session tracking.
   • BLog a hash of the session ID instead of the full session ID.
   • CLog the session ID only for failed authentication attempts.
   • DLog the session ID but encrypt the log file.
   Reveal Solution Discussion Select an answer first