Secure Auditing and Logging CASENET Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A multinational company must comply with GDPR and local data-residency laws. They are designing an audit trail for a .NET application that processes personal data. The audit trail must support accountability and be retained for a specific period. The company operates data centers in the EU and the US. Which design decision is most appropriate?

   • AEncrypt all audit logs and store them in the US, because encryption makes the data non-personal.
   • BStore all audit logs in a single centralized location in the EU, regardless of where the data is processed.
   • CAvoid logging any personal data and store only timestamps and event types in a global log aggregator.
   • DStore audit logs in the same region as the data being processed, and ensure that the logs contain only pseudonymous identifiers where possible.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A developer is implementing a logging solution for a .NET application that handles personal data. The developer wants to log the user's email address to help with debugging. The privacy team has stated that email addresses are considered personal data and must be protected. Which approach best balances debugging needs with privacy requirements?

   • ALog the full email address but restrict access to the log files to the development team only.
   • BLog the email address only in the development environment and use a generic user ID in production.
   • CEncrypt the email address before logging it and store the encryption key in the application's source code.
   • DLog a one-way hash of the email address instead of the plaintext email.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A .NET application uses a logging framework that buffers log entries in memory before writing them to disk. The application crashes unexpectedly, and the security team discovers that the last 30 minutes of security events were not written to the log file. What should be changed to prevent this in the future?

   • AIncrease the buffer size to hold more events.
   • BDisable logging entirely to avoid buffer issues.
   • CConfigure the logging framework to flush the buffer to disk immediately for security-critical events.
   • DWrite logs to a faster disk to reduce the time the buffer is full.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations team wants to detect a brute-force attack on a .NET web application. The application logs login failures with the username and source IP. Which monitoring and alerting strategy is most effective?

   • AAlert when the total number of login failures across all users exceeds a daily threshold.
   • BAlert on any single login failure event.
   • CAlert when any user logs in successfully after a failure.
   • DAlert when the number of login failures from a single IP exceeds a threshold within a time window.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A .NET application has a global exception handler that logs exceptions. The development team wants to ensure that the exception handler does not accidentally log sensitive data from the HttpRequest object. What is the best practice?

   • ALog the query string, which may contain tokens.
   • BLog the entire HttpRequest object, including headers and form data.
   • CLog only the exception type, message, and stack trace, and avoid logging request properties.
   • DLog the request body as a string for debugging.
   Reveal Solution Discussion Select an answer first