Secure Auditing and Logging CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC team wants to detect a potential SQL injection attack by monitoring application logs. The application logs the full SQL query for each database request. Which monitoring rule would be most effective?

   • AAlert when the number of database queries exceeds a threshold.
   • BAlert when the application returns an HTTP 500 error.
   • CAlert when the database user is 'admin'.
   • DAlert when a SQL query contains typical injection patterns such as 'OR 1=1' or a single quote followed by SQL keywords.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A multinational company must comply with both GDPR and local data residency laws. They store audit logs that contain personal data of EU citizens. The logs are currently stored in a data center in the US. What is the best approach to meet both GDPR and data residency requirements?

   • AStore all logs in the US and rely on the company's privacy policy to justify the transfer.
   • BStore EU citizens' logs in an EU data center and non-EU logs in the US, ensuring that EU data does not leave the EU.
   • CAnonymize all personal data in logs before storing them in the US.
   • DEncrypt all logs and store them in the US, arguing that encryption protects the data.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations center (SOC) monitors a Java application's logs for signs of a brute-force attack. The application logs failed login attempts with username and IP address. The SOC wants to receive an alert when a single IP address has more than 10 failed logins within 5 minutes. Which approach should be used?

   • AStore the logs in a database and run a SQL query every 24 hours to find IPs with more than 10 failures.
   • BAdd a filter in the application to block any IP address after a single failed login.
   • CConfigure a log aggregation tool to parse the logs and trigger an alert based on a threshold rule.
   • DManually review the logs every hour to identify suspicious IP addresses.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which set of events should be included in a secure audit log for a Java web application?

   • ASuccessful and failed authentication attempts, authorization failures, and changes to security settings.
   • BOnly successful authentication attempts, to reduce log volume.
   • CAll user input values, including passwords and credit card numbers, for debugging purposes.
   • DOnly application errors and exceptions, because they indicate system faults.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A web application allows users to submit feedback that is logged for quality assurance. An attacker submits feedback containing the string: 'User logged out\n[ERROR] Database connection failed'. The log viewer displays this as two separate lines. What is the best defense against this log injection?

   • AStore feedback in a database and never log it.
   • BUse a logging library that automatically truncates long strings.
   • CLog the feedback only if it does not contain the word 'ERROR'.
   • DSanitize the feedback input by removing or escaping newline characters before logging.
   Reveal Solution Discussion Select an answer first