Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A financial services company runs a trading application that experiences extreme load volatility. The operations team has set static thresholds for CPU and memory, but during peak trading hours, these thresholds are often exceeded, causing many false alerts. Conversely, during off-peak hours, genuine issues may not trigger alerts because the baseline is lower. The team wants to reduce false positives while maintaining sensitivity to real anomalies. Which approach is most effective?

   • ADisable all alerts during peak hours and rely on manual monitoring.
   • BUse a single static threshold set at the 95th percentile of peak usage to avoid false alerts.
   • CImplement dynamic thresholding that adapts to historical patterns and alert on deviations from the expected baseline.
   • DSet multiple static thresholds for different times of day and manually update them weekly.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A DevSecOps team notices that the same type of incident (database connection exhaustion) has occurred three times in the past month. Each time, the on-call engineer manually restarted the database and the alert was resolved. The team wants to prevent recurrence and improve the system. Which action is most aligned with a feedback loop?

   • AAutomate the restart process so that the database restarts automatically when the alert fires.
   • BConduct a post-incident review to identify the root cause, then implement a code fix and add a regression test to the CI/CD pipeline.
   • CAdd more on-call engineers to handle the alerts faster.
   • DIncrease the alert threshold so that the alert does not fire as often.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large organization has separate teams for security and operations. The security team uses a SIEM for log analysis, while the operations team uses a separate monitoring tool for metrics and alerts. During a recent incident, the two teams could not correlate security events with performance data, delaying response. The organization wants to improve collaboration and response time without replacing both tools entirely. Which approach best addresses this?

   • ABuild a custom integration that forwards security alerts from the SIEM to the operations monitoring tool, and vice versa, to create a unified incident view.
   • BHave the security team manually export logs and send them to the operations team during incidents.
   • CRequire both teams to use the same tool by migrating to a single new platform.
   • DCreate a shared dashboard that displays data from both tools side by side, but keep the tools separate.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is migrating a legacy monolithic application to a containerized microservices architecture. The security team wants to maintain visibility into user authentication and authorization events across all services. What is the most effective approach?

   • AUse a tracing system to capture request flows and infer authentication failures from trace spans.
   • BStore logs locally on each container's filesystem and have developers review them during incidents.
   • CLog authentication events only at the API gateway, since all requests pass through it.
   • DEnable structured logging in each service for authentication and authorization events, and forward all logs to a central log management platform.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst needs to investigate a suspected data breach. The company has logs from the firewall, the application server, and the database. Which logging practice is most important for the investigation?

   • ADelete logs older than 30 days to reduce storage costs.
   • BEnsure all logs are stored in a centralized location with synchronized timestamps and sufficient retention.
   • CStore logs in a proprietary format that only the original application can read.
   • DKeep logs only on the local servers where they are generated.
   Reveal Solution Discussion Select an answer first