Which are useful security events to capture in an application layer log?

• A. Errors in domain specific business logic, authorization failure
• B. Successful logins and page views
• C. System reboots
• D. Backup completions

Answer: (A)

Capturing security-relevant events at the application layer focuses on events that indicate access control problems or misuse of business rules. Logging errors in domain-specific logic and authorization failures provides a clear audit trail of when a user attempts an action they shouldn’t be allowed to perform, or when the application rejects operations due to security constraints. These events are directly tied to security posture: they help detect privilege misuse, misconfigurations, or attempted exploits, and they support incident response and forensic analysis.

While successful logins and page views tell you who is using the system and what pages are being accessed, they are routine activity rather than indicators of security issues. System reboots and backup completions are operational events about infrastructure and data management, not about application-level security checks or access control.

So focusing on authorization failures and domain logic errors gives meaningful insight into security events at the application layer.