Which actions require audit trail coverage according to 10.2.2?

Which actions require audit trail coverage according to 10.2.2?

• A. All actions taken by any individual with root or administrative privileges.
• B. All actions by any individual without privileges.
• C. Only login attempts by root accounts.
• D. Only changes to configuration.

Answer: (A)

Auditing privileged activity is what 10.2.2 emphasizes. The idea is that all actions performed by anyone with root or administrative privileges must be captured by automated audit trails. These users can affect the most sensitive parts of the environment, including access to cardholder data, changes to critical settings, and commands that alter system behavior. By recording who did what, when, and from where, you can reconstruct events, hold privileged users accountable, and respond effectively to incidents. Other options don’t provide the necessary breadth. Logging actions by users without privileged access misses the activities of those with elevated rights, which are most risky. Focusing only on login attempts by root accounts ignores the full range of privileged actions, such as data access or configuration changes. Limiting audit coverage to configuration changes captures only a portion of privileged activity and misses data access and other impactful actions.

Auditing privileged activity is what 10.2.2 emphasizes. The idea is that all actions performed by anyone with root or administrative privileges must be captured by automated audit trails. These users can affect the most sensitive parts of the environment, including access to cardholder data, changes to critical settings, and commands that alter system behavior. By recording who did what, when, and from where, you can reconstruct events, hold privileged users accountable, and respond effectively to incidents.

Other options don’t provide the necessary breadth. Logging actions by users without privileged access misses the activities of those with elevated rights, which are most risky. Focusing only on login attempts by root accounts ignores the full range of privileged actions, such as data access or configuration changes. Limiting audit coverage to configuration changes captures only a portion of privileged activity and misses data access and other impactful actions.