Continuous Monitoring Tools DSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A platform team wants to monitor a legacy application that only exposes metrics via a custom text file on the host. They need to scrape these metrics into Prometheus. Which component should they use?

   • AA custom Prometheus exporter that reads the file and exposes the metrics in Prometheus format.
   • BGrafana to read the text file and display it.
   • CAlertmanager to parse the file and generate alerts.
   • DThe Prometheus Pushgateway to push the file contents directly.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the main purpose of log aggregation in a DevSecOps environment?

   • ATo delete logs after a certain period to save storage
   • BTo encrypt logs in transit
   • CTo generate alerts based on log content
   • DTo centralize logs from multiple sources for easier analysis
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A team uses Grafana with Prometheus and Loki. They want to create a single dashboard that shows both metrics and logs for a specific service, with the ability to jump from a metric anomaly to the corresponding logs. Which approach is most effective?

   • AConfigure Loki to scrape Prometheus metrics and store them as logs.
   • BExport Prometheus metrics to a CSV file and import it into Loki.
   • CUse Grafana's built-in data source integration to combine Prometheus and Loki in a single dashboard and use log-linking annotations.
   • DUse two separate dashboards, one for metrics and one for logs, and switch between them manually.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A team wants to detect a potential brute-force attack on their web application. They have centralized logs in a SIEM. Which alerting configuration would best detect this attack pattern?

   • AAlert when the count of failed login attempts from a single IP exceeds 10 within 5 minutes
   • BAlert when total HTTP 500 errors exceed 1% of all requests
   • CAlert when a new user account is created
   • DAlert when CPU usage on the web server exceeds 80%
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization must retain security logs for at least one year to meet compliance requirements. They currently store logs in a SIEM that only retains data for 30 days. What should they do?

   • AConfigure the SIEM to forward logs to a long-term storage solution such as an object store with lifecycle policies
   • BCompress logs and store them on the local disk of the SIEM server
   • CIncrease the SIEM's storage capacity to hold one year of logs
   • DDelete logs after 30 days and rely on summary reports
   Reveal Solution Discussion Select an answer first