Secure Auditing and Logging CASENET Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the purpose of setting up monitoring and alerting based on application logs?

   • ATo reduce the amount of log data stored.
   • BTo enable timely detection of and response to security events.
   • CTo replace the need for manual log review.
   • DTo automatically fix security vulnerabilities in the application.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A healthcare organization's .NET application must log access to patient records. The audit trail must support investigations, but the organization also has a strict data minimization policy. The logs are stored for two years. Which approach best balances auditability with data minimization?

   • ALog a pseudonymous patient identifier, the action performed, timestamp, and the user's role, but not the patient's name or full record.
   • BLog the patient's name and date of birth to identify the record.
   • CLog the full patient record that was accessed to provide complete context.
   • DLog only the user ID and timestamp, without specifying what action was taken.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A .NET application's global exception handler logs the exception object directly. The security review found that exception messages sometimes contain SQL query parameters, including user input. The team wants to keep the exception details for debugging but prevent sensitive data from being logged. What is the best approach?

   • ALog the exception message and stack trace, but sanitize the message to remove any user-supplied values.
   • BDo not log exceptions; instead, display the exception details to the user for transparency.
   • CLog the full exception object to a separate file that only developers can access.
   • DLog only the exception type and timestamp, and discard the message.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A .NET web application logs exception details using a custom middleware that serializes the exception object. During a security review, you discover that stack traces and inner exception messages are being written to the application log file. The application handles credit card numbers in request bodies. Which change best reduces the risk of sensitive data leakage while preserving useful diagnostic information?

   • ASerialize the exception to JSON and log it only when the user is an administrator.
   • BLog only the exception type, message, and a correlation ID, and ensure the logging framework filters out properties that match a sensitive-data pattern.
   • CDisable all exception logging and rely on the global error page to display the exception details to the user.
   • DLog the full exception object but encrypt the log file at rest using a managed key.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A .NET application logs exceptions using a third-party logging library. The library automatically logs the exception's Data dictionary, which sometimes contains sensitive values added by the application. The team wants to keep the Data dictionary for debugging but prevent sensitive data from being logged. What is the best approach?

   • AConfigure the logging library to filter out specific keys from the Data dictionary that are known to be sensitive.
   • BRemove all entries from the Data dictionary before logging the exception.
   • CLog the Data dictionary to a separate file that is not accessible to support staff.
   • DDisable logging of the Data dictionary entirely.
   Reveal Solution Discussion Select an answer first