Secure Auditing and Logging CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a key requirement for an audit trail to support accountability?

   • AIt must be accessible to all users for transparency.
   • BIt must include the full contents of every database record changed.
   • CIt must record the identity of the user and the action performed.
   • DIt must be stored in the same database as the application data.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is required by regulation to keep audit logs for five years. They currently use a centralized logging system that stores logs in an Elasticsearch cluster. The security team is concerned that an attacker who compromises the Elasticsearch cluster could modify or delete logs. Which additional control would most effectively address this concern?

   • ASet the log index to read-only after each day and rely on the operating system's file permissions.
   • BTake daily snapshots of the Elasticsearch indices and store them in the same cluster.
   • CEnable Elasticsearch audit logging and restrict access to the cluster to a small group of administrators.
   • DUse an append-only index with a retention policy and sign each log entry with a key stored in a hardware security module (HSM).
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which technique can be used to prevent sensitive data leakage in logs?

   • AEncrypting the entire log file with a strong algorithm.
   • BUsing a logging framework that automatically logs all method parameters.
   • CStoring logs in a separate database with restricted access.
   • DMasking or redacting sensitive fields before writing them to the log.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which statement best describes the primary purpose of an audit log in a .NET application?

   • ATo replace the need for database backups by storing all application data.
   • BTo improve application performance by caching frequently accessed data.
   • CTo store user preferences and application settings for performance optimization.
   • DTo provide a tamper-evident record of security-relevant actions for accountability and forensic analysis.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A government agency's .NET application must provide an audit trail that supports accountability for actions performed by administrators. The audit trail must be able to answer 'who did what, when, and from where'. Which information should be included in each audit log entry?

   • AThe user's password hash and session token.
   • BThe full request body and response body.
   • COnly the user ID and timestamp.
   • DUser ID, action performed, timestamp, and source IP address.
   Reveal Solution Discussion Select an answer first