Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is investigating a potential data exfiltration. They have logs from multiple sources, but the timestamps are in different time zones and formats, making correlation difficult. The team needs to quickly piece together the sequence of events. What should they do first?

   • AManually convert all timestamps to a common time zone and format using a spreadsheet.
   • BUse a log management platform that normalizes timestamps to a standard format (e.g., UTC) and supports correlation across sources.
   • CIgnore timestamps and rely on the order of log entries as they appear in each source.
   • DRequest that all systems be reconfigured to use the local time zone of the security team.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company runs a hybrid infrastructure with on-premises servers and cloud VMs. They want a single view of logs and metrics from both environments, with alerts sent to a common incident management platform. What is the best approach?

   • AUse a cloud-native monitoring service only for cloud resources and keep on-premises logs in a local SIEM.
   • BDeploy separate monitoring stacks for on-premises and cloud, and manually correlate data during incidents.
   • CExport all logs to a data lake and run ad-hoc queries when needed.
   • DSet up agents on all servers to forward logs and metrics to a central monitoring platform that supports both environments, and configure alerts to route to the incident management tool.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevSecOps team is deploying a new microservices-based application. The security team requires that all authentication failures and privilege escalations be captured for audit, while the operations team needs to track request latency and error rates. The team wants a single tool that can ingest both structured security events and application performance metrics, and then trigger alerts when either a spike in 403 errors or a latency threshold is exceeded. Which approach should the team take?

   • ASet up a single log file that captures both security events and performance data, then use a simple grep script to check for anomalies each night.
   • BUse a centralized observability platform that ingests logs, metrics, and traces, with alert rules defined on both security log patterns and performance metrics.
   • CConfigure the application to write security events to a separate SIEM, and use a different APM tool for metrics, then manually correlate the two dashboards.
   • DOnly collect application logs and rely on developers to review them periodically for security and performance issues.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary benefit of integrating logging, monitoring, and alerting into a unified pipeline?

   • AIt eliminates the need for manual code reviews
   • BIt automatically patches vulnerabilities in production
   • CIt guarantees zero downtime for applications
   • DIt provides real-time observability and faster incident response
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevSecOps team notices that a specific error rate in production has increased after a recent deployment. They want to use this feedback to improve the next release. What is the most effective action?

   • ARoll back the deployment immediately and ignore the monitoring data.
   • BAdd a regression test that reproduces the error pattern and include it in the CI pipeline, then adjust monitoring alerts to catch similar issues.
   • CCreate a bug ticket and assign it to the development team, but do not change the monitoring setup.
   • DIncrease the error rate threshold in alerts to reduce noise.
   Reveal Solution Discussion Select an answer first