Secure Auditing and Logging CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A government agency requires that all audit logs be retained for seven years and be available for forensic investigation. The logs are currently stored on the application server's local disk. Which improvement is most important to meet the retention and forensic requirements?

   • AMove the logs to a centralized, write-once-read-many (WORM) storage system with a retention policy.
   • BIncrease the log file size limit to avoid rolling over old logs.
   • CSet the log files to read-only after each day's rotation.
   • DCompress the logs daily and store them in a password-protected archive on the same server.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your team has implemented structured logging for a .NET application. You now need to set up monitoring and alerting to detect a potential brute-force attack. Which alerting rule is most effective for this purpose?

   • AAlert when the application's CPU usage exceeds 90% for five minutes.
   • BAlert when any single log entry contains the word 'error'.
   • CAlert when more than five failed login attempts occur for the same user account within a 10-minute window.
   • DAlert when the total number of log entries exceeds a fixed threshold per hour.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What should be avoided when logging security-relevant events in a .NET application?

   • ALogging passwords, credit card numbers, and other secrets.
   • BLogging the timestamp of the event.
   • CLogging the source IP address of the request.
   • DLogging the username associated with an authentication attempt.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security incident occurred in a .NET application, and the incident response team needs to determine what happened. The application logs to a local file, but the file was truncated by an attacker. The team also has a SIEM that receives logs from the application via a forwarder. Which source is the most reliable for the investigation?

   • AThe SIEM, because it receives logs in near real-time and may have a copy of the events before the local file was truncated.
   • BThe application's memory dump, because it contains the exact state of the application at the time of the incident.
   • CThe Windows Event Log, because it is always tamper-proof.
   • DThe local log file, because it contains the most detailed information.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A .NET Core application is deployed to a Kubernetes cluster. The application uses the default console logger. The operations team wants to collect logs in a central location and be able to search them by correlation ID. Which approach is the most effective?

   • AConfigure the application to write structured logs to stdout in JSON format and use a log shipper (e.g., Fluentd) to forward them to a central log store.
   • BUse the Windows Event Log provider even though the application runs on Linux containers.
   • CSend logs directly to a third-party SaaS logging service from the application code using a custom HTTP client.
   • DWrite logs to a local file on each pod and use kubectl exec to access the files when needed.
   Reveal Solution Discussion Select an answer first