Secure Auditing and Logging CASENET Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary risk of logging sensitive data such as credit card numbers or passwords?

   • ALogs become too large and consume excessive storage space.
   • BSensitive data may be exposed to unauthorized individuals who gain access to log files.
   • CSensitive data in logs makes debugging more difficult because it obscures other information.
   • DLogging sensitive data slows down the application due to encryption overhead.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is configuring Serilog for an ASP.NET Core application. They want to log security-relevant events such as login failures and authorization denials, but they are concerned about performance and log volume. Which configuration approach best meets these needs?

   • ALog only exceptions to the console sink and rely on the default ASP.NET Core logging.
   • BLog all events at Information level and above to a single file sink.
   • CDisable logging in production to avoid performance overhead.
   • DUse separate log levels and filters to capture security events at Warning level, and write them to a dedicated security log sink.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which measure helps protect logs from unauthorized access or modification?

   • AStoring logs in the application's root directory.
   • BUsing write-once, read-many (WORM) storage or append-only logging.
   • CDisabling logging after a certain number of entries to save space.
   • DGranting write permissions to all authenticated users.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company's compliance policy requires that audit logs be retained for at least one year and be resistant to tampering. The current .NET application writes logs to a local file. What is the most effective way to meet these requirements?

   • AEmail the log files to the compliance officer daily.
   • BStore logs in a database table with update permissions granted to the application.
   • CUse a write-once-read-many (WORM) storage solution for log files.
   • DCompress the log files and store them on the same server.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is reviewing logs from a .NET application and notices that the logs contain many entries from a single IP address that are not related to any user action. The entries are all at Information level and appear to be automated health checks. The analyst wants to reduce noise in the logs to focus on security events. What is the best approach?

   • AConfigure the logging framework to filter out known health-check endpoints and log them at Debug level instead of Information.
   • BBlock the IP address of the health-check service in the firewall.
   • CIncrease the log level to Error for all events.
   • DIgnore the health-check logs and focus only on Warning and Error level events.
   Reveal Solution Discussion Select an answer first