Secure Auditing and Logging CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A .NET application logs user activity for audit purposes. The logs currently include the user's full name, email address, and the URL they requested. The privacy team has determined that email addresses are considered personal data and should not be logged unless necessary. What is the best practice?

   • ALog a pseudonymous user identifier instead of the email address, and retain the email only in a separate secure store.
   • BRemove all user identifiers from logs to protect privacy.
   • CContinue logging email addresses because they are needed for user identification.
   • DLog the email address but encrypt the entire log file.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company must maintain audit logs for regulatory compliance. The logs are generated by a .NET application and stored on a network share. The security team is concerned that an administrator with access to the share could modify logs. The compliance team requires a way to detect any modification. What is the most effective approach?

   • AEncrypt the log files with a key stored on the same server.
   • BUse a separate logging server that only accepts append-only writes and periodically sends cryptographic hashes of the log to an external immutable store.
   • CGrant the application full control over the log files and rely on the administrator to be trustworthy.
   • DStore logs in a SQL database with the application using a login that has update permissions.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A team is building a new .NET Core microservice that handles user registration. The service logs all validation failures. The security team requires that the logs do not contain passwords or security questions, but they also want to be able to investigate brute-force attempts against specific usernames. The team is using Serilog. Which configuration best meets both requirements?

   • ALog the full request body but encrypt the log file with a strong key.
   • BLog the username, timestamp, and validation error code, and use a Serilog enricher to redact any property named 'password' or 'securityQuestion'.
   • CLog only the timestamp and a generic 'validation failed' message, without any user identifier.
   • DLog the username and the raw exception message, but only in the development environment.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a logging best practice for a .NET application?

   • AAvoid logging any events to reduce storage costs and improve performance.
   • BLog all user input verbatim, including passwords and credit card numbers, to aid debugging.
   • CLog full stack traces for every exception, including sensitive variable values.
   • DLog security-relevant events such as authentication successes and failures, authorization decisions, and input validation failures.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You are designing an audit log system for a multi-tenant SaaS application. The system must ensure that logs from different tenants cannot be accessed by other tenants, and that logs are protected from modification. Which architecture best meets these requirements?

   • AEncrypt all logs with a single key and store them in a shared blob container.
   • BWrite logs to a separate file per tenant and set NTFS permissions so only the tenant's administrators can read their file.
   • CUse a centralized logging service that supports tenant-scoped access controls and append-only storage with cryptographic signing.
   • DStore all logs in a single database table with a tenant ID column and rely on application-level filtering.
   Reveal Solution Discussion Select an answer first