One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data. How can you design your logging system to…

Question

Options

• AWrite the log concurrently in the cloud and on premises.
• BUse a SQL database and limit who can modify the log table.
• CDigitally sign each timestamp and log entry and store the signature.
• DCreate a JSON dump of each log entry and store it in Google Cloud Storage.

• A
  10% (3)
• B
  3% (1)
• C
  83% (25)
• D
  3% (1)

Explanation

Digitally signing each log entry (C) is correct because cryptographic signatures create a mathematically verifiable proof that a log entry was created by a trusted source and has not been tampered with - any modification to the signed content invalidates the signature, giving you strong authenticity guarantees.

Why the distractors fail:

• A (cloud + on-premises): Redundant storage improves availability and disaster recovery, but a tampered log copied to both locations is still a tampered log - duplication doesn't prove authenticity.
• B (SQL + restricted access): Access controls reduce who can alter logs, but they don't provide cryptographic proof that logs weren't altered - a privileged insider or attacker with elevated access could still modify records undetected.
• D (JSON in GCS): Storing a serialized dump in cloud storage is just another form of storage - without a signature or hash, there's no mechanism to detect whether the dump was modified after creation.

Memory tip: Think of digital signatures like a wax seal on a letter - if anyone tampers with the contents, the seal breaks. Access controls are like a locked filing cabinet: they limit access but can't tell you if someone with a key made changes.

No community discussion yet for this question.