Secure Auditing and Logging CASENET Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A financial services company must ensure that audit logs cannot be modified by an attacker who compromises the web server. The logs are written to the local file system. The compliance team requires proof of log integrity for external auditors. What should you implement?

   • AUse a centralized, append-only log server with cryptographic hash chaining and periodic hash submission to an external system.
   • BSet NTFS permissions so only the application pool identity can write to the log folder.
   • CWrite logs to a network share with Everyone read/write permissions for easy access.
   • DEncrypt the log files with a password known only to the application administrator.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A .NET application writes logs to a local file. The security team wants to ensure that logs are not lost if the disk becomes full. The application must continue to run and log security events. What is the best approach?

   • AConfigure the logging framework to use a fallback sink, such as a network share or a different disk, when the primary disk is full.
   • BStop the application when the disk is full to prevent data loss.
   • COverwrite the oldest log entries when the disk is full.
   • DIgnore the disk full condition and hope the application continues to work.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is a benefit of using a logging framework like Serilog or NLog in .NET?

   • AThey automatically encrypt all log files.
   • BThey provide structured logging and configurable sinks for secure and efficient log management.
   • CThey guarantee that no sensitive data is ever logged.
   • DThey eliminate the need for any manual logging code.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A .NET application uses NLog for logging. The team wants to ensure that security events are never missed due to logging misconfiguration. Which configuration practice is most important?

   • ADisable async logging to ensure logs are written synchronously.
   • BUse a fallback rule that logs any event at Warning level or above to a secondary sink if the primary sink fails.
   • CSet the minimum log level to Trace to capture everything.
   • DLog to the console only, because it is always available.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A financial application must maintain an audit trail for all money-transfer transactions. The audit trail must support accountability by linking each transaction to the user who performed it. The application uses ASP.NET Core Identity for authentication. Which set of data should be recorded for each transaction to best meet the requirement?

   • AUser ID, timestamp, transaction amount, source and destination account numbers, and a hash of the previous audit entry.
   • BTransaction ID, timestamp, and the raw JSON request body.
   • CUser ID, timestamp, and the IP address of the client.
   • DUser name, timestamp, and the HTTP request URL only.
   Reveal Solution Discussion Select an answer first