Design and Implement Auditability, Traceability, and Accountability of Data Events CCSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a recommended practice for when to log data events?

   • ALog only failed access attempts to reduce noise
   • BLog all data access and modification events, including successful and failed attempts
   • CLog only events that exceed a certain size threshold
   • DLog only events that occur during business hours
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a primary mechanism for ensuring the integrity of log data?

   • ACompressing logs to reduce storage size
   • BEncrypting logs with a symmetric key
   • CStoring logs in a database with a primary key
   • DHashing logs and storing the hash values in a separate, secure location
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is investigating a potential data exfiltration. The logs show that a user downloaded a large amount of data from a database. The analyst needs to determine if this is normal behavior. Which log analysis technique is most effective?

   • AReview the database schema
   • BDisable the user's account
   • CCompare the download volume to the user's historical behavior
   • DCheck the user's access permissions
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A healthcare organization uses a multi-cloud environment with SaaS applications, IaaS virtual machines, and PaaS databases. During an audit, the security team discovers that data access events from the SaaS application lack the user's IP address, while database events lack the application name. Which action best addresses the root cause of these gaps?

   • ADefine a standardized event attribute schema and require all cloud services to map their events to it.
   • BImplement a data loss prevention (DLP) solution to monitor data access across all environments.
   • CConfigure the SaaS application to send logs directly to the organization's SIEM.
   • DEnable verbose logging on all cloud services and centralize logs in a SIEM.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A cloud application allows users to upload files. The security team wants to ensure that users cannot deny having uploaded a specific file. Which mechanism provides non-repudiation for the upload action?

   • ADigital signature of the upload event by the user's private key
   • BLogging the upload event with a timestamp
   • CStoring the file in a restricted-access folder
   • DEncryption of the file with a symmetric key
   Reveal Solution Discussion Select an answer first