Logging and audit trails in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to write a log entry using Python's logging module.

Cybersecurity

import logging
logging.basicConfig(filename='app.log', level=logging.[1])
logging.info('User logged in')

Drag options to blanks, or click blank then click option'

AERROR

BDEBUG

CWARNING

DINFO

Attempts:

3 left

💡 Hint

Common Mistakes

Using DEBUG logs too much detail for normal operations.

The level parameter sets the minimum severity of messages to log. INFO logs informational messages like user actions.

2fill in blank

medium

Complete the command to view the last 50 lines of the audit log file.

Cybersecurity

tail -n [1] /var/log/audit/audit.log

Drag options to blanks, or click blank then click option'

A100

B50

C10

D500

Attempts:

3 left

💡 Hint

Common Mistakes

Using too few lines like 10 might miss important events.

The -n 50 option tells tail to show the last 50 lines of the file.

3fill in blank

hard

Fix the error in the audit rule to log all executions of the 'passwd' command.

Cybersecurity

-w /usr/bin/passwd -p [1] -k passwd_changes

Drag options to blanks, or click blank then click option'

Aa

Bw

Cx

Dr

Attempts:

3 left

💡 Hint

Common Mistakes

Using r or w which monitor reads or writes, not executions.

The -p x flag tells auditd to watch for executions (x) of the file.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that filters audit events with severity higher than 4.

Cybersecurity

filtered_events = {event['id']: event for event in events if event['severity'] [1] [2]

Drag options to blanks, or click blank then click option'

A>

B4

C<

D5

Attempts:

3 left

💡 Hint

Common Mistakes

Using < or wrong threshold values.

The condition event['severity'] > 4 filters events with severity greater than 4.

5fill in blank

hard

Fill all three blanks to create a filtered audit log dictionary with uppercase event IDs and severity above 3.

Cybersecurity

filtered_logs = [1]: [2] for [3], v in audit_logs.items() if v['severity'] > 3

Drag options to blanks, or click blank then click option'

Ak.upper()

Bv

Ck

Ditem

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong variable names or not converting keys to uppercase.

This comprehension uses k.upper() as keys, v as values, and iterates over k, v pairs.