How are audit trail files protected from unauthorized modifications?

• A. Current audit trail files are protected from unauthorized modifications via encryption only.
• B. Current audit trail files are protected from unauthorized modifications via access control mechanisms, physical segregation, and/or network segregation.
• C. Current audit trail files are protected by keeping them on a read-only CD.
• D. No protection is required.

Answer: (B)

Protecting audit trail files from unauthorized modifications relies on putting controls around who can touch the logs, where the logs are stored, and how access to them is limited across the network. Encryption protects confidentiality, but it does not stop someone with access from altering the log content or knocking the data out of integrity; encryption alone doesn’t enforce who can modify or ensure the logs remain unaltered. In contrast, access control mechanisms restrict write and change permissions to authorized personnel only, which directly reduces the chance of tampering. Physical segregation places audit logs on secure, separate storage or systems, making tampering harder by isolating the logs from general computation environments. Network segregation further reduces risk by limiting which parts of the network can reach the log storage, preventing attackers from easily accessing or modifying the logs from other segments. Together, these layers create a robust defense against unauthorized modifications. Options that rely solely on encryption, or that rely on a single fragile control like a read-only CD, or that suggest no protection is needed, do not provide the comprehensive tamper-resistance required for audit trails.