Security Maintenance and Monitoring CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a security incident, the incident response team needs to determine whether an attacker exfiltrated data from a .NET application's database. Which evidence source is most useful?

   • AThe company's employee email logs.
   • BDatabase audit logs showing SELECT queries and the client IP addresses that issued them.
   • CThe server's CPU performance logs from the time of the incident.
   • DThe application's source code repository commit history.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard · select all that apply

   A .NET application was breached. The incident response team is developing a post-incident action plan. Which actions are appropriate to include? Select all that apply.

   • ADelete all logs from the incident to free up storage space.
   • BReview and update the incident response plan based on lessons learned.
   • CConduct a root cause analysis to identify the vulnerability that was exploited.
   • DImmediately notify all customers without verifying the scope of the breach.
   • EImplement additional monitoring to detect similar attack patterns.
   Check answers Discussion Select an answer first
4. 8foundation · easy

   What is a key benefit of maintaining audit logs of security maintenance activities?

   • AThey provide evidence of compliance during audits and help identify gaps in security processes.
   • BThey replace the need for vulnerability scanning.
   • CThey ensure that all application users have strong passwords.
   • DThey automatically fix vulnerabilities without human intervention.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary reason to apply security patches to the .NET framework and third-party libraries in a deployed application?

   • ATo fix known vulnerabilities that could be exploited by attackers.
   • BTo add new features that were requested by end users.
   • CTo improve the application's performance and reduce memory usage.
   • DTo change the application's user interface to match current design trends.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A .NET application is hosted in a hybrid cloud environment. The security team needs to implement centralized logging and monitoring that captures security-relevant events from both on-premises and cloud components. The compliance team requires that logs be retained for 1 year and that access to logs be audited. The budget is limited, so the team cannot use a commercial SIEM. What is the best approach?

   • AStore logs locally on each server and have the security team manually collect them monthly for archival.
   • BConfigure the application to write logs to a shared network folder on the on-premises file server, and set the folder permissions to allow all users to read for transparency.
   • CUse Azure Monitor only for cloud components and rely on Windows Event Viewer for on-premises servers, with no central aggregation.
   • DUse a self-hosted open-source log management platform (e.g., ELK stack) on a dedicated server, forward logs from all sources to it, and configure log rotation and access controls to meet the retention and audit requirements.
   Reveal Solution Discussion Select an answer first