Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is migrating to a microservices architecture and needs to implement logging. The security team requires that all authentication events be retained for at least one year for compliance, while the operations team wants to keep debug logs for only 7 days to manage storage costs. The company uses a centralized log management platform. Which logging strategy best balances compliance and cost?

   • AUse different retention policies for different log types: 1 year for security logs, 7 days for debug logs.
   • BStore all logs for one year to ensure compliance.
   • CStore all logs for 7 days and rely on backups for compliance.
   • DDisable debug logging to reduce storage and keep only security logs.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   After deploying a new feature, the monitoring system shows a gradual increase in memory usage of the application over several days. The team has not received any alerts because the usage is still below the set threshold. What should the team do to avoid a potential outage?

   • ARestart the application daily to clear memory.
   • BCreate an alert based on the rate of memory growth to detect the trend before it reaches the threshold.
   • CWait until the memory usage reaches the threshold and then investigate.
   • DIncrease the memory threshold to avoid future alerts.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of a security log that should be collected in a DevSecOps environment?

   • ADatabase query logs that show SQL statements executed
   • BApplication debug logs that record variable values
   • CWeb server access logs that record HTTP requests
   • DFirewall logs that record allowed and denied network traffic
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to integrate logging, monitoring, and alerting into a unified pipeline. They currently have separate tools: a log aggregator, a metrics dashboard, and an alert manager. The goal is to enable real-time observability and faster incident response. Which action best achieves this integration?

   • ACreate a central dashboard that pulls data from all three tools and requires an operator to manually cross-reference alerts with logs.
   • BUse a single platform that ingests logs, metrics, and traces, and allows alerts to be triggered by any combination of these signals.
   • CKeep the tools separate but have the alert manager send emails to the operations team for every log error.
   • DReplace all monitoring with a simple log search tool and have developers watch for anomalies.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A security team is configuring alerts for a new system. They have a limited number of on-call analysts and need to prioritize alerts based on potential impact. They have identified three types of events: a single failed login, a brute-force attack with many failed logins, and a successful login from a new device. Which alerting approach best balances detection and noise?

   • AAlert on the brute-force attack pattern and the successful login from a new device, but not on single failed logins.
   • BDisable all alerts and rely on daily log analysis.
   • CAlert on every failed login, because any failed login could indicate an attack.
   • DAlert only on the brute-force attack pattern, and log the other events for later review.
   Reveal Solution Discussion Select an answer first