Monitoring and Logging ECDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A team has set up alerting for their application, but they are receiving too many alerts during peak traffic hours, most of which are not actionable. They want to reduce noise without missing real issues. Which strategy is most effective?

   • ADisable alerts for non-critical services.
   • BIncrease all alert thresholds to a very high level.
   • COnly alert on weekends when traffic is lower.
   • DUse dynamic thresholds based on historical baselines and implement alert aggregation.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of logging in a DevSecOps environment?

   • ATo automatically remediate security vulnerabilities in real time
   • BTo record events and transactions that can be used for debugging, auditing, and security analysis
   • CTo store configuration files for backup purposes
   • DTo replace the need for application performance monitoring
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company needs to analyze logs from multiple applications to identify security anomalies. They want to use a tool that supports searching and visualization. Which tool should they choose?

   • AA monitoring tool that only tracks CPU and memory metrics.
   • BA simple text editor to search through log files manually.
   • CELK stack (Elasticsearch, Logstash, Kibana) with Beats for log shipping.
   • DA database that stores logs but has no search or visualization interface.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   During a ransomware incident, the incident response team needs to determine the initial attack vector and the extent of lateral movement. The company has centralized logs from firewalls, endpoints, and Active Directory. Which analysis approach is most effective?

   • ACorrelate firewall logs with endpoint detection and response (EDR) alerts and Active Directory authentication logs to trace the attack path.
   • BRestore all systems from backups immediately.
   • CFocus only on endpoint logs to identify the infected machine.
   • DReview firewall logs only to see external connections.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A DevOps team is implementing monitoring for a new service. They want to ensure that the monitoring system itself does not become a single point of failure and that alerts are actionable. Which set of practices best achieves this?

   • AStore monitoring data in the same database as application data to reduce complexity.
   • BRun the monitoring stack in a separate region and configure multiple alerting channels (e.g., email, Slack, PagerDuty).
   • CDeploy the monitoring stack on the same Kubernetes cluster as the application and use a single alerting channel.
   • DUse a single monitoring tool that collects all metrics and logs, and rely on dashboards only.
   Reveal Solution Discussion Select an answer first