Security Maintenance and Monitoring CASENET Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A .NET application is compromised, and the incident response team needs to determine whether the attacker accessed sensitive customer data. The application logs authentication and authorization events, but the logs are stored on the same server as the application. What is the most important action to preserve evidence?

   • ACopy the logs to a separate, secure storage location and verify the integrity of the copies using hashes.
   • BChange the application's logging level to verbose and wait for new logs to be generated before analyzing.
   • CReboot the server to clear any malicious processes, then collect the logs from the fresh boot.
   • DDelete the logs from the server to prevent the attacker from altering them, then analyze the copies.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A financial services company runs a .NET 6 web application in Azure App Service. The compliance team requires that all security patches be applied within 14 days of release, but the operations team is concerned about downtime during business hours. The application has a staging slot that mirrors production. Which maintenance scheduling approach best meets both requirements?

   • AWait for the next monthly security review meeting to approve all patches before applying them to production.
   • BApply patches directly to production during the next scheduled maintenance window, which occurs every 30 days.
   • CApply patches to production immediately upon release, regardless of the time of day, to ensure the shortest possible exposure window.
   • DDeploy patches to the staging slot, run automated tests, then swap to production during a brief window within the 14-day period.
   Reveal Solution Discussion Select an answer first