Which action is explicitly associated with the audit logs and should be controlled?

Which action is explicitly associated with the audit logs and should be controlled?

• A. Initialization, stopping, or pausing the audit logs.
• B. Archiving old logs.
• C. Backups of audit data.
• D. Routine log rotation.

Answer: (A)

Protecting the integrity of audit logs hinges on preventing tampering with the logging process itself. If you can initialize, stop, or pause the audit logs, you can hide events or disable security monitoring. That makes it the action most directly tied to the ongoing capture of audit data and something that must be tightly controlled so logs always reflect what happened. Archiving old logs, backing up audit data, and routine log rotation are important operational tasks for retention, availability, and manageability, but they don’t directly affect whether events are being recorded in real time. They should be governed as part of standard data management, not as the primary control over the log's active generation.

Protecting the integrity of audit logs hinges on preventing tampering with the logging process itself. If you can initialize, stop, or pause the audit logs, you can hide events or disable security monitoring. That makes it the action most directly tied to the ongoing capture of audit data and something that must be tightly controlled so logs always reflect what happened.

Archiving old logs, backing up audit data, and routine log rotation are important operational tasks for retention, availability, and manageability, but they don’t directly affect whether events are being recorded in real time. They should be governed as part of standard data management, not as the primary control over the log's active generation.