Security Maintenance and Monitoring CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the first step in an effective security incident response procedure?

   • ARecovery of systems to normal operation.
   • BDetection and identification of a potential security incident.
   • CContain the incident to prevent further damage.
   • DEradication of the root cause of the incident.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A .NET application is suspected of being breached. The security team has limited staff and must decide whether to contain the incident by taking the server offline or keep it online to gather more forensic evidence. The application is business-critical, and downtime is costly. The compliance team requires that the incident be reported to regulators within 72 hours. What is the most appropriate decision?

   • AKeep the server online to continue collecting evidence, and delay containment until the forensic analysis is complete.
   • BNotify the regulators immediately, then continue monitoring the server for 72 hours before taking any action.
   • CImmediately restore the server from the last backup and delete the original logs to prevent the attacker from accessing them.
   • DTake the server offline to contain the breach, capture a memory dump and disk image for forensics, and then bring up a clean backup while preserving the original for analysis.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A .NET application processes credit card data and is subject to PCI DSS. The security team is implementing a security maintenance plan and must ensure that all maintenance activities are logged and that the logs are reviewed regularly. The team has a limited budget and cannot afford a dedicated log management solution. What is the most effective way to meet the PCI DSS logging and review requirement?

   • AUse a free cloud-based log management service that stores logs off-site, and grant all developers access to the logs for transparency.
   • BDisable logging for non-security events to reduce log volume, and review only the security event logs monthly.
   • CConfigure the application and servers to write security-relevant events to the Windows Event Log, and use a scheduled task to export the logs to a compressed archive that is reviewed weekly by the security team.
   • DStore logs on the local server and have the security team review them only when an incident occurs.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A .NET e-commerce application runs on IIS with SQL Server. The security team wants to detect credential-stuffing attempts and account lockouts in near real time. They need a solution that captures both successful and failed logins, correlates them with the user account, and triggers an alert when multiple failures occur within a short window. What should the team configure?

   • AEnable IIS Failed Request Tracing and review the logs manually each morning to identify accounts with multiple failed logins.
   • BEnable Windows Event Log for Application and set the maximum log size to 1 GB so all login events are retained for later analysis.
   • CEnable ASP.NET health monitoring events for authentication failures and configure a custom provider to write to a SIEM with a correlation rule for multiple failures per account.
   • DConfigure SQL Server audit to log all SELECT statements on the Users table and use a scheduled job to count failed logins from the audit trail.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services company runs a .NET Framework 4.8 web application on Windows Server 2019. The security team has identified a critical vulnerability in a third-party NuGet package used for PDF generation. The vendor has released a patched version, but the application also uses a custom library that depends on the vulnerable version. The change advisory board requires a rollback plan and a test window before production deployment. What is the most appropriate first step?

   • AImmediately deploy the patched NuGet package to production to remediate the critical vulnerability, then test the custom library in production.
   • BRemove the custom library from the application to eliminate the dependency conflict, then deploy the patched NuGet package.
   • CUpdate the NuGet package to the patched version in a development environment, run the full regression test suite, and verify the custom library's compatibility before scheduling the production change.
   • DAdd a Web Application Firewall rule to block requests that trigger the PDF generation feature, and defer the patch until the next scheduled maintenance window.
   Reveal Solution Discussion Select an answer first