A security team wants to detect a potential brute-force attack on their web application. They have access to application logs that record login attempts, including username, IP address, and timestamp. Which alerting strategy is most effective for this detection?

Alert when a user logs in from a new device.

Alert on every failed login attempt.

Alert when the number of failed logins from a single IP exceeds a threshold within a time window.

Alert when total logins exceed a daily average.

In a DevSecOps context, what is the primary purpose of logging?

To store only successful transactions for business reporting

To record events and activities from applications, systems, and security controls for analysis, troubleshooting, and audit

To replace the need for real-time monitoring by storing historical data

To automatically remediate security incidents without human intervention

A team is monitoring a web application. They have set up alerts for high CPU usage and high error rates. However, they are missing a slow degradation that occurs gradually over several days. What is the most likely reason, and what should they do?

The thresholds are too low, so they should lower them to catch gradual changes.

The monitoring interval is too long, so they should collect metrics every second.

The alerts are based on static thresholds, so they should use trend-based anomaly detection to detect gradual changes.

The team is not logging enough, so they should add more debug logs.

A DevSecOps team is building a unified observability pipeline. They have multiple data sources: application logs, infrastructure metrics, and security events. They want to correlate these signals to detect a complex attack that involves multiple steps. What is the most effective approach?

Use a SIEM platform that ingests logs and security events, and a separate APM tool for metrics and traces.

Store all data in separate systems and manually correlate during an investigation.

Use a tracing system to capture all requests and infer security events from trace data.

Ingest all logs, metrics, and security events into a single data platform that supports correlation queries and automated alerting.

In the context of monitoring strategies, what do metrics primarily provide?

A high-level, numerical view of system behavior over time

A detailed narrative of every user interaction with the system

A record of security events for compliance auditing

A chronological sequence of steps for a single request

EC-CouncilDevSecOps Essentials

Domain 6Objective 4

Integrating Logging, Monitoring, and Alerting DSE Practice Questions (Page 9)

Part of the DevSecOps Monitoring and Feedback domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

5concepts

Questions 41–45

41application · medium
A security team wants to detect a potential brute-force attack on their web application. They have access to application logs that record login attempts, including username, IP address, and timestamp. Which alerting strategy is most effective for this detection?
Select an answer first
42foundation · easy
In a DevSecOps context, what is the primary purpose of logging?
Select an answer first
43expert · medium
A team is monitoring a web application. They have set up alerts for high CPU usage and high error rates. However, they are missing a slow degradation that occurs gradually over several days. What is the most likely reason, and what should they do?
Select an answer first
44expert · medium
A DevSecOps team is building a unified observability pipeline. They have multiple data sources: application logs, infrastructure metrics, and security events. They want to correlate these signals to detect a complex attack that involves multiple steps. What is the most effective approach?
Select an answer first
45foundation · easy
In the context of monitoring strategies, what do metrics primarily provide?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.