Secure Auditing and Logging CASENET Practice Questions (Page 11)

Questions 51–53

1. 51application · medium

   During a code review, you find that a developer logged the entire HTTP request object, including headers and form data, to a file. The application processes payment card data. Which action is the most appropriate to remediate this issue?

   • AMask the credit card numbers in the form data before logging the request object.
   • BLog the request object only for users with the 'Admin' role.
   • CEncrypt the log file with a strong algorithm and keep the key in the application's configuration file.
   • DRemove the logging of the request object and log only a correlation ID and the request path.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   How should audit trails be managed to support compliance requirements?

   • AThey should be retained for a defined period and protected from alteration.
   • BThey should be stored in plain text to facilitate easy access.
   • CThey should be accessible to all employees for transparency.
   • DThey should be deleted immediately after an incident is resolved.
   Reveal Solution Discussion Select an answer first
3. 53expert · hard

   A .NET application has a global exception handler that logs all exceptions. Recently, a security incident occurred where an attacker triggered exceptions that contained SQL query strings in the message. The logs were forwarded to a SIEM, and the SQL queries were visible to the security team. The team wants to prevent this from happening again without losing the ability to debug SQL-related errors. Which approach is the most effective?

   • ALog the exception type, a hash of the exception message, and a correlation ID, and store the full exception details in a separate secure database.
   • BDisable SQL error messages in the database connection string so exceptions never contain SQL.
   • CModify the exception handler to scrub the exception message for SQL keywords before logging.
   • DLog the full exception to the SIEM but restrict access to the SIEM to a few security analysts.
   Reveal Solution Discussion Select an answer first