Secure Auditing and Logging CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following best describes the primary purpose of secure audit logging in a Java application?

   • ATo provide a chronological record of security-relevant events that supports detection, investigation, and compliance verification.
   • BTo provide a backup of the application's source code for disaster recovery purposes.
   • CTo improve application performance by reducing the amount of code needed for error handling.
   • DTo replace the need for application monitoring by storing all application output in a single file.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A Java application logs authentication events. During a code review, the security engineer notices that the login method logs the entire user object, which includes the password hash and personal details. What is the most appropriate remediation?

   • ALog the entire user object but redact the password hash using a custom filter.
   • BEncrypt the log file so that the password hash is not readable.
   • CModify the logging to include only the username, timestamp, and success/failure status.
   • DDisable logging for authentication events to avoid logging sensitive data.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A financial institution is required to retain audit logs for seven years and must ensure that logs cannot be altered by an attacker who compromises the application server. Which approach best meets the integrity and retention requirements?

   • AWrite logs to a local file on the application server and set file permissions to read-only for all users.
   • BCompress the log files daily and store them in the application's backup directory.
   • CEncrypt the log file with a key stored on the same server to prevent unauthorized reading.
   • DStream logs in near real-time to a centralized, write-once storage system (e.g., WORM storage) on a separate server with restricted access.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial institution must maintain audit logs for seven years to meet regulatory requirements. The logs contain sensitive transaction data. The security team is designing the log storage architecture. Which combination of controls should be implemented to ensure log integrity and confidentiality?

   • AStore logs in a database with a trigger that automatically deletes entries older than seven years.
   • BStore logs in a standard file system with read-only permissions for all users.
   • CStore logs on a write-once-read-many (WORM) storage system with encryption at rest and strict access controls.
   • DCompress logs and store them in a cloud object storage bucket with public read access.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A SOC team is overwhelmed by false-positive alerts from the SIEM. The SIEM is configured to alert on any failed login, any HTTP 500 error, and any SQL query containing a single quote. The team wants to reduce false positives while still detecting real attacks. Which change is most effective?

   • AOnly alert on SQL queries that contain 'OR 1=1'.
   • BIncrease the alert threshold for failed logins to 100 per hour.
   • CDisable alerts for HTTP 500 errors.
   • DCreate correlation rules that combine multiple events, such as multiple failed logins from the same IP followed by a successful login.
   Reveal Solution Discussion Select an answer first