Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a best practice when using ILogger in ASP.NET Core?

   • AUse string concatenation to build log messages for better performance
   • BLog at the Information level for all messages to ensure nothing is missed
   • CLog the entire request object to capture all details
   • DUse structured logging with named placeholders to capture context without logging sensitive data
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the purpose of monitoring and alerting on error patterns in an application?

   • ATo reduce the number of errors by optimizing code
   • BTo detect suspicious activity that may indicate an attack
   • CTo replace the need for logging
   • DTo automatically fix errors in the application
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company must keep application logs for two years for compliance, but the log storage budget is limited. The logs are currently stored in a SIEM that charges per gigabyte per month. The security team wants to retain detailed logs for incident investigation but reduce costs. Which strategy best balances cost and compliance?

   • AStore detailed logs in the SIEM for 90 days, then archive them to low-cost cold storage for the remaining period.
   • BReduce log verbosity to only errors and store them in the SIEM for two years.
   • CKeep all logs in the SIEM for two years because compliance requires immediate access to all logs.
   • DDelete logs older than 90 days to save storage costs.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the purpose of a custom exception class in .NET?

   • ATo automatically log all exceptions without writing any code
   • BTo provide a way to throw exceptions with specific information that can be handled separately
   • CTo make exceptions invisible to the user
   • DTo prevent any exception from being thrown in the application
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   Your team is building a new ASP.NET Core API. The operations team requires that all errors be logged in a central location with full stack traces, but the security team insists that log files must not be accessible to unauthorized personnel. Which approach best meets both requirements?

   • AStore logs in the application's root directory with default file permissions.
   • BLog errors only to the Windows Event Log, which is automatically secure.
   • CUse Serilog with a sink that writes to a centralized log management service, and restrict access to the service using role-based permissions.
   • DWrite logs to a shared network folder that all developers can access for convenience.
   Reveal Solution Discussion Select an answer first