Which action related to audit logs is specified as needing control?

Which action related to audit logs is specified as needing control?

• A. Initialization, stopping, or pausing the audit logs.
• B. Routine log rotation.
• C. Backups of audit data.
• D. Archiving old logs.

Answer: (A)

The main idea is that audit logs must be protected from tampering, including the ability to disable or pause them. If someone can initialize, stop, or pause the audit logs, they can hide events and investigative trails, undermining detection and forensic ability. That’s why this action is the one that needs strict control: you want logging to stay active at all times, and any attempt to alter its operation should be restricted to authorized personnel and monitored with alerts. In practical terms, organizations implement controls so that starting or stopping logging requires privileged access, automatic alerts trigger if logging is paused, and activities around logging are tightly logged themselves. This aligns with PCI DSS requirements that audit trails be protected and that critical security events remain traceable. Routine log rotation, backups of audit data, and archiving old logs are important maintenance tasks, but they do not address the fundamental risk of turning off logging. They can be done securely, but the critical control focus is preventing the ability to initialize, stop, or pause the logs in the first place.

The main idea is that audit logs must be protected from tampering, including the ability to disable or pause them. If someone can initialize, stop, or pause the audit logs, they can hide events and investigative trails, undermining detection and forensic ability. That’s why this action is the one that needs strict control: you want logging to stay active at all times, and any attempt to alter its operation should be restricted to authorized personnel and monitored with alerts.

In practical terms, organizations implement controls so that starting or stopping logging requires privileged access, automatic alerts trigger if logging is paused, and activities around logging are tightly logged themselves. This aligns with PCI DSS requirements that audit trails be protected and that critical security events remain traceable.

Routine log rotation, backups of audit data, and archiving old logs are important maintenance tasks, but they do not address the fundamental risk of turning off logging. They can be done securely, but the critical control focus is preventing the ability to initialize, stop, or pause the logs in the first place.