Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security operations center (SOC) receives thousands of low-severity alerts daily from various monitoring tools. Analysts are overwhelmed and missing critical alerts. The team wants to improve the effectiveness of their alerting. What should they do first?

   • AIncrease the thresholds on all alerts to reduce the number of alerts.
   • BDisable all alerts and rely on daily log reviews.
   • CImplement alert correlation and deduplication to group related alerts and suppress known benign patterns.
   • DHire more analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How do monitoring and alerting contribute to a feedback loop in DevSecOps?

   • ABy ensuring that all security vulnerabilities are fixed before deployment
   • BBy providing insights that drive improvements in code, infrastructure, and security practices
   • CBy automatically deploying code changes to production
   • DBy replacing the need for security testing in the development phase
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is adopting DevSecOps and wants to integrate security monitoring into their existing CI/CD pipeline. They want to automatically scan container images for vulnerabilities and also collect runtime security logs from production. Which integration approach is most aligned with DevSecOps principles?

   • AIntegrate vulnerability scanning into the CI/CD pipeline and feed runtime security logs into the same monitoring platform used for application metrics.
   • BRun vulnerability scans only in production on a monthly basis and store logs in a separate SIEM.
   • CUse a dedicated security team to handle all scanning and log analysis outside of the DevOps workflow.
   • DPerform manual security reviews before each release and rely on the operations team to watch security logs after deployment.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A team is designing monitoring for a distributed system. They need to understand the flow of a single user request across multiple microservices, identify which service is slow, and also see the overall error rate. Which combination of monitoring approaches should they use?

   • AUse only infrastructure metrics like CPU and memory to infer service performance.
   • BUse only application logs to trace the request by searching for correlation IDs.
   • CUse distributed tracing to follow the request path and metrics to track error rates and latency.
   • DUse a single log aggregator and manually correlate timestamps across services.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After a production incident, a DevSecOps team reviews the monitoring data and finds that a misconfigured firewall rule allowed excessive failed authentication attempts. They want to prevent similar incidents. What should they do as part of a feedback loop?

   • ACreate a new alert rule that triggers on the same failed-authentication pattern and assign it to the security team.
   • BUpdate the infrastructure-as-code templates to include a security baseline for firewall rules, and add a regression test to the CI pipeline.
   • CDocument the incident in a post-mortem and share it with the team, but make no changes to the system.
   • DIncrease the logging verbosity on the firewall to capture more details for the next incident.
   Reveal Solution Discussion Select an answer first