Secure Auditing and Logging CASENET Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which log event would be most appropriate to trigger an alert for a potential security incident?

   • AMultiple failed login attempts from the same IP address within a short time.
   • BA user updating their profile information.
   • CAn application restart after a scheduled deployment.
   • DA user successfully logging in during business hours.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In .NET, which configuration aspect is important for securely configuring a logging framework?

   • AConfiguring the logging framework to exclude sensitive data and use appropriate log levels.
   • BSetting the minimum log level to Verbose to capture all details.
   • CDisabling all logging in production to improve performance.
   • DStoring logging configuration in the application code for easy changes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   Your organization's compliance team requires that application audit logs be tamper-evident and retained for at least one year. The application runs on Windows Servers in a private cloud. You need to design a logging solution that meets these requirements with minimal operational overhead. Which approach should you choose?

   • AStore logs in a SQL Server database with a trigger that prevents UPDATE and DELETE statements.
   • BWrite logs to a local file and enable the Windows Event Log's 'Audit Logon Events' policy to track who accesses the file.
   • CCompress logs daily and store them in a password-protected ZIP archive on the same server.
   • DUse a centralized log collector that signs each log entry with a hardware security module (HSM) key and stores the logs in an append-only object store.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   Your .NET application uses Serilog to write structured logs to a central Elasticsearch cluster. You need to detect a possible account takeover where an attacker uses a valid session token. Which log-based detection rule is most effective?

   • AAlert when the application returns a 500 error for a specific endpoint.
   • BAlert when a user changes their password more than once in a day.
   • CAlert when the total number of log entries per hour exceeds a threshold.
   • DAlert when the same session ID is used from two different IP addresses within a short time window.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A .NET application is being audited for compliance. The auditor requires that logs include the outcome of each security-relevant action (success or failure). The current logging code only logs exceptions, not successful actions. What is the best way to meet this requirement?

   • ARely on the exception logger to capture failures and assume successes are not needed.
   • BAdd explicit logging statements after successful security actions, such as login and authorization decisions, with the outcome.
   • CLog only the exceptions and infer success from the absence of errors.
   • DLog all HTTP 200 responses as successful actions.
   Reveal Solution Discussion Select an answer first