What should I log from within my application?
-
Login and logout of users, Critical transactions (eg. fund transfer across accounts), Failed login attempts, Account lockouts, Violation of policies
-
Login and logout of users, Critical transactions (eg. fund transfer across accounts), Failed login attempts, Account lockouts, Violation of policies, Forgot password correct and wrong credentials
-
Login and logout of users, Critical transactions (eg. fund transfer across accounts), Failed login attempts, Account lockouts, Violation of policies, password sharing logs
-
Login and logout of users, Critical transactions (eg. fund transfer across accounts), Failed login attempts, Account lockouts, Violation of policies, password sharing logs, race condition logs
Application security logging must capture authentication events (login, logout, failed attempts), policy violations, and critical transactions. Option B correctly adds 'Forgot password correct and wrong credentials' - this is crucial because it captures both successful and failed password reset attempts, which are sensitive authentication events. Options A, C, D are incorrect - C and D incorrectly include 'password sharing logs' and 'race condition logs' which are not standard application logging practices.
A well-instrumented application should log security-relevant events so they can be audited and investigated: user login/logout, critical transactions like fund transfers, failed login attempts, account lockouts, and policy violations, plus events around password-recovery flows (both successful and failed attempts), since these are common targets for account-takeover attacks. Logging this broader set of events gives security teams better visibility into abuse patterns than a narrower log scope.