Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevSecOps team is deploying a microservices-based application. They need to ensure that security-relevant events (e.g., failed logins, privilege escalations) are captured alongside application performance data, and that the operations team is notified when the rate of failed logins spikes. What should they implement?

   • ASeparate logging tools for application, system, and security logs, each with its own alerting rules, reviewed independently by different teams.
   • BA monitoring tool that collects metrics and traces only, with alerts on CPU and memory usage, and a separate manual process for reviewing security logs.
   • CCentralized log aggregation with a searchable index and a dashboard that the operations team checks manually each shift.
   • DA unified pipeline that ingests application, system, and security logs into a time-series database, with threshold-based alerts on the failed-login rate.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A DevSecOps team manages a critical application that must be highly available. They are configuring alerts for a new service. They have limited on-call staff and cannot afford alert fatigue, but they also cannot miss a real outage. The service has variable traffic, and a single failed health check can be transient. Which alerting strategy best balances these constraints?

   • ASet a very high error rate threshold so only catastrophic failures trigger alerts.
   • BDisable health check alerts and rely on customer complaints to detect outages.
   • CAlert only if the health check fails for a sustained period, such as 5 minutes, and use a separate alert for error rate spikes.
   • DAlert immediately on any failed health check, because any failure could indicate an outage.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A company is required to retain security logs for 1 year for compliance, but their log management platform is expensive and they are running out of storage. They also need to search recent logs quickly for incident response. What is the most cost-effective approach that still meets requirements?

   • ACompress logs and store them on the same platform for the full year, but reduce the log verbosity to save space.
   • BStore all logs in a low-cost archival storage tier after 30 days, while keeping recent logs in a fast-searchable tier.
   • CDelete logs older than 30 days to free up storage.
   • DStore logs only in memory and rely on real-time streaming to a SIEM.
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A company is migrating to a microservices architecture. They are concerned about the cost of logging at scale. They want to maintain security visibility without exceeding their budget. They have identified that a large portion of logs are debug messages from development. What is the best strategy?

   • AStore all logs in a low-cost archival tier immediately, without indexing.
   • BDisable logging in production and rely on staging logs for debugging.
   • CLog at debug level in production to ensure no information is missed.
   • DUse a log sampling strategy that captures all security-relevant events and a representative sample of debug logs.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After a major incident, a DevSecOps team reviews the monitoring data and finds that the alert for database connection failures was misconfigured and never fired. The team fixes the alert rule. What additional step should the team take to ensure continuous improvement?

   • AReplace the database with a more reliable managed service.
   • BAdd more dashboards to visualize database metrics.
   • CDocument the incident and update the runbook, then schedule a review of all alert rules to identify similar misconfigurations.
   • DIncrease the log retention period to ensure more data is available for future investigations.
   Reveal Solution Discussion Select an answer first