Which statement best describes audit trail security under these requirements?

Which statement best describes audit trail security under these requirements?

• A. Audit trails must be protected from unauthorized modifications
• B. Audit trails can be edited freely
• C. Audit trails should be publicly available
• D. Audit trails are optional

Answer: (A)

Audit trails, which record security-relevant events, must be protected from unauthorized modifications to preserve their integrity and usefulness for investigations. If entries can be edited by anyone, a breach could be hidden or misrepresented, defeating the purpose of an audit trail. In PCI DSS, logs should be safeguarded with proper access controls, tamper-evident storage, and retention policies so that only authorized actions can affect them and the original data remains verifiable. Logs that are publicly available would risk exposing sensitive information and enable tampering, and audits are not optional in PCI DSS since traceability and accountability are essential for payment security.

Audit trails, which record security-relevant events, must be protected from unauthorized modifications to preserve their integrity and usefulness for investigations. If entries can be edited by anyone, a breach could be hidden or misrepresented, defeating the purpose of an audit trail. In PCI DSS, logs should be safeguarded with proper access controls, tamper-evident storage, and retention policies so that only authorized actions can affect them and the original data remains verifiable. Logs that are publicly available would risk exposing sensitive information and enable tampering, and audits are not optional in PCI DSS since traceability and accountability are essential for payment security.