10.2.5 requires tracking of which items?

10.2.5 requires tracking of which items?

• A. Only password resets.
• B. Use of and changes to authentication mechanisms—including creation of new accounts and elevation of privileges—and all changes, additions, or deletions to accounts with root or administrative privileges.
• C. Only changes to user roles without creating accounts.
• D. Only login attempts by administrators.

Answer: (B)

Tracking changes to authentication methods and privileged accounts is what this requirement focuses on. It means you must log the use of and changes to authentication mechanisms—such as adjustments to password policies, the introduction or modification of multi-factor authentication, or other methods used to prove identity—and you must record all changes, additions, or deletions to accounts that have root or other administrative privileges, including creation of new accounts and any elevation of privileges. This visibility is essential because it catching who gained access, how they gained it, and whether those steps align with policy. By keeping detailed, reviewable logs of who did what, when, and to which account, you can detect unauthorized account creation, privilege escalation, or alterations to authentication controls, which are common attack paths. While password resets, changes to user roles, or admin login attempts are relevant events, they do not alone satisfy the broader requirement to monitor both authentication mechanism changes and all privileged-account changes.

Tracking changes to authentication methods and privileged accounts is what this requirement focuses on. It means you must log the use of and changes to authentication mechanisms—such as adjustments to password policies, the introduction or modification of multi-factor authentication, or other methods used to prove identity—and you must record all changes, additions, or deletions to accounts that have root or other administrative privileges, including creation of new accounts and any elevation of privileges. This visibility is essential because it catching who gained access, how they gained it, and whether those steps align with policy. By keeping detailed, reviewable logs of who did what, when, and to which account, you can detect unauthorized account creation, privilege escalation, or alterations to authentication controls, which are common attack paths. While password resets, changes to user roles, or admin login attempts are relevant events, they do not alone satisfy the broader requirement to monitor both authentication mechanism changes and all privileged-account changes.