Secure Auditing and Logging CASENET Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a common mistake when integrating error handling with logging?

   • AIncluding exception messages that contain sensitive user input.
   • BLogging the exception with a unique identifier for correlation.
   • CLogging the exception details in the catch block.
   • DUsing a try-catch block to handle exceptions.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A .NET application is deployed in a high-availability environment with multiple instances behind a load balancer. The security team wants to detect a distributed brute-force attack that spreads across many IP addresses but targets a single user account. The application logs login failures with username and source IP. Which monitoring strategy is most effective?

   • AAlert when a user logs in successfully after multiple failures from different IPs.
   • BAlert when the total number of login failures for a single username exceeds a threshold across all instances within a time window.
   • CAlert when any single IP address has more than five login failures in an hour.
   • DAlert when the overall login failure rate across all users exceeds a global threshold.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the purpose of ensuring log integrity in a .NET application?

   • ATo make logs easier to read and understand.
   • BTo prevent unauthorized modification or deletion of log entries.
   • CTo ensure logs are encrypted in transit.
   • DTo reduce the storage space required for logs.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A .NET application is being migrated from .NET Framework to .NET 8. The team wants to adopt modern logging practices. Which logging framework configuration is the most appropriate for a new ASP.NET Core application?

   • AUse the built-in ILogger abstraction with a third-party provider like Serilog or NLog, configured via appsettings.json.
   • BUse a custom static logging class that writes to a text file without any configuration.
   • CUse the Console.WriteLine method to output logs to the console in production.
   • DUse System.Diagnostics.Trace directly in every class to write to the Windows Event Log.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A .NET developer is implementing logging for a password reset feature. The logs must record that a reset was requested and completed, but must not expose the password reset token or the user's password hash. What should the developer do?

   • ALog the reset token in the log so support can help users who have issues.
   • BLog the password hash to verify the reset was successful.
   • CLog the event type, user ID, and timestamp, but never log the token or hash values.
   • DLog the full URL of the reset page, which includes the token as a query parameter.
   Reveal Solution Discussion Select an answer first