Where should audit trail files be backed up?

Where should audit trail files be backed up?

• A. Centralized log server or media difficult to alter
• B. Local backup on same server
• C. Public cloud storage
• D. Printed copies

Answer: (A)

Auditing and monitoring require that audit trails be preserved intact and retrievable for review. Backing up audit trail files to a centralized log server or to media that is difficult to alter creates a tamper-resistant, centralized repository. This protects evidence of events even if individual systems are compromised, and supports retention and forensic investigations. Centralized storage also allows consistent access controls and easier collection of logs across multiple devices. In contrast, backing up on the same server’s local storage risks losing integrity if the server is breached, since both live and backup copies can be altered; public cloud storage might be usable with proper controls but doesn’t by itself guarantee immutability unless specific safeguards are in place; printed copies are not practical for large volumes, searchability, or long-term retention.

Auditing and monitoring require that audit trails be preserved intact and retrievable for review. Backing up audit trail files to a centralized log server or to media that is difficult to alter creates a tamper-resistant, centralized repository. This protects evidence of events even if individual systems are compromised, and supports retention and forensic investigations. Centralized storage also allows consistent access controls and easier collection of logs across multiple devices. In contrast, backing up on the same server’s local storage risks losing integrity if the server is breached, since both live and backup copies can be altered; public cloud storage might be usable with proper controls but doesn’t by itself guarantee immutability unless specific safeguards are in place; printed copies are not practical for large volumes, searchability, or long-term retention.