Security Maintenance and Monitoring CASENET Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A .NET application is hosted on Azure and must comply with SOC 2. The security team needs to monitor for unauthorized access and ensure logs are tamper-evident. Which combination of Azure services and practices is most appropriate?

   • AUse Azure Monitor but allow administrators to delete logs after 30 days.
   • BSend logs to Azure Monitor and enable immutable storage for the Log Analytics workspace to prevent log alteration.
   • CDisable logging for performance reasons and rely on periodic manual audits.
   • DStore logs only in the application's local file system with write permissions for all developers.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare organization's .NET application processes protected health information (PHI). The compliance officer requires evidence that the application is scanned for vulnerabilities at least quarterly and that any critical findings are remediated within 30 days. The development team uses a CI/CD pipeline that deploys to Azure App Service. What should the team implement to meet this requirement?

   • ARun a manual penetration test once a year and document the results in the compliance officer's annual report.
   • BEnable IIS request logging and review the logs monthly for suspicious activity, then report any findings to the compliance officer.
   • CConfigure a scheduled vulnerability scan using Azure Security Center (Defender for Cloud) that runs every 90 days and generates a compliance report for the compliance officer.
   • DUse a NuGet package vulnerability checker only during the build process and rely on the developer's manual review for compliance evidence.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A .NET application is deployed in a containerized environment using Docker and Kubernetes. The security team needs to conduct regular vulnerability scans of the container images and the running application. The scans must be integrated into the CI/CD pipeline without slowing down the build process significantly. Which approach best meets these requirements?

   • AUse a container image scanner (e.g., Trivy) in the CI/CD pipeline to scan images for known vulnerabilities, and schedule a separate scan of the running cluster using a Kubernetes security tool (e.g., kube-bench).
   • BRely on the Kubernetes cluster's built-in security features and skip regular vulnerability scans to reduce operational overhead.
   • CRun a full vulnerability scan on every build, including all base images and dependencies, without any caching or optimization.
   • DScan the container images only during the monthly maintenance window to avoid any impact on the build process.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the main purpose of logging security-relevant events in a .NET application?

   • ATo provide a record that can be used to detect and investigate security incidents.
   • BTo replace the need for security testing during development.
   • CTo improve the application's runtime performance by reducing memory usage.
   • DTo automatically fix security vulnerabilities without human intervention.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the goal of the 'recovery' phase in security incident response for a .NET application?

   • ATo restore the application and its data to a known good state.
   • BTo delete all logs to prevent sensitive information from leaking.
   • CTo patch all vulnerabilities immediately without testing.
   • DTo identify the attacker's identity and motives.
   Reveal Solution Discussion Select an answer first