Monitoring and Logging ECDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a security incident, the incident response team needs to quickly determine which systems were affected and what actions were taken by an attacker. The company has centralized logging but no formal incident response playbook. What is the most effective way to use monitoring and logging to support the investigation?

   • ADisable all external network access to prevent further damage.
   • BRestore all systems from the last known good backup.
   • CSearch logs for the attacker's IP address and correlate with authentication and process execution logs.
   • DReview the monitoring dashboards for performance metrics.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key metric to monitor for application performance?

   • ANumber of open issues
   • BNumber of code commits
   • CNumber of developers on the team
   • DResponse time
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of setting up alerting mechanisms in monitoring?

   • ATo generate daily reports for management
   • BTo notify the appropriate teams when a metric exceeds a predefined threshold
   • CTo automatically fix the underlying issue without human intervention
   • DTo replace the need for manual log analysis
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A DevOps team wants to implement monitoring for a new application. They have limited operational staff and need to prioritize which metrics to monitor first. Which set of metrics should they focus on to establish a baseline?

   • AEmployee satisfaction survey scores.
   • BCPU usage, memory usage, disk I/O, and network throughput on all hosts.
   • CNumber of open GitHub issues.
   • DNumber of lines of code committed per day.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services company must demonstrate to auditors that only authorized personnel accessed customer data and that all access attempts are recorded. What should they implement to meet this requirement?

   • ARestrict database access to a single admin account and share the password among team members.
   • BEnable detailed audit logging on the database and centralize those logs in a tamper-evident log management system.
   • CStore logs in the local database server's log directory without any backup.
   • DUse application-level logging that records only successful transactions.
   Reveal Solution Discussion Select an answer first