Security Maintenance and Monitoring CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An ASP.NET Core application is deployed to Azure. The security team wants to detect brute-force attacks on the login endpoint. Which monitoring setup is most effective?

   • ALog all login attempts to a text file on the web server and review it weekly.
   • BEnable Application Insights and create an alert rule that triggers when multiple failed login attempts occur from the same IP address within a short time.
   • CDisable logging for the login endpoint to reduce overhead.
   • DMonitor CPU usage and alert when it exceeds 80%.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A .NET application uses Azure Application Insights for telemetry. The security team wants to detect a potential data exfiltration attempt where an attacker uses a compromised API key to download a large volume of records. What should the team configure in Application Insights?

   • AEnable custom events for API key usage and set up a metric alert that triggers when the count of download events exceeds a threshold within a 5-minute window.
   • BEnable snapshot debugging and capture a memory dump whenever an exception is thrown during a download request.
   • CConfigure a log-based alert that triggers whenever any user downloads a file from the application.
   • DEnable dependency tracking and review the dependency telemetry for any calls to the database that return more than 100 rows.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team must conduct a vulnerability scan of a .NET application that handles credit card data (PCI DSS). The scan must not disrupt production traffic. The team has a SAST tool and a DAST tool. Which approach is most appropriate?

   • ARun the SAST tool on the source code in a CI/CD pipeline and run the DAST tool against a staging environment that mirrors production.
   • BRun the DAST tool against production during off-peak hours to get the most accurate results.
   • CRun the DAST tool on the production database directly to test for SQL injection.
   • DRun only the SAST tool on the source code and skip DAST because the application is already in production.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company runs a .NET Framework application on Windows Server. The security team wants to conduct a vulnerability scan that includes the operating system, the .NET runtime, and the application's custom code. Which combination of tools is most appropriate?

   • AUse only a network vulnerability scanner on the server's IP address.
   • BUse a network vulnerability scanner for the OS and a static application security testing (SAST) tool for the custom code.
   • CUse only a SAST tool on the application source code.
   • DRun a penetration test manually without any automated scanning.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A government contractor's .NET application must comply with FedRAMP. The security team is planning patch management. Which practice is most aligned with FedRAMP requirements?

   • AEstablish a patch management policy that defines timelines for critical, high, and moderate vulnerabilities, and document all deviations.
   • BUse automated patching tools without any manual review.
   • CDelay patching until the next audit to demonstrate a consolidated list of changes.
   • DApply patches only when the vendor releases an emergency out-of-band update.
   Reveal Solution Discussion Select an answer first