{
  "id": "09",
  "content": [
    {
      "type": "heading",
      "text": "Monitoring & Incident Response"
    },
    {
      "type": "text",
      "html": "<pre><code class='language-php'>$log=['ts'=>time(),'uid'=>$uid,'ip'=>$_SERVER['REMOTE_ADDR']??'','event'=>'login_fail'];\nerror_log(json_encode($log));\n</code></pre>"
    },
    {
      "type": "text",
      "html": "Force resets for exposed users, invalidate sessions, and keep immutable audit trails."
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "On detecting a credential leak, you should:",
        "options": [
          {
            "id": "a",
            "text": "Force reset + invalidate sessions"
          },
          {
            "id": "b",
            "text": "Ignore"
          },
          {
            "id": "c",
            "text": "Disable logs"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": "Audit trails should include:",
        "options": [
          {
            "id": "a",
            "text": "Logins, fails, password changes, MFA enrollments"
          },
          {
            "id": "b",
            "text": "Only page views"
          },
          {
            "id": "c",
            "text": "Only server restarts"
          }
        ],
        "correct": [
          "a"
        ]
      }
    ]
  }
}