What events must be logged for system-level objects?

• A. Creation and deletion of system-level objects are logged.
• B. Only creation is logged.
• C. Only deletion is logged.
• D. No logging required for objects.

Answer: (A)

Tracking changes to system-level objects through logging creation and deletion events is essential because these events mark changes to critical components of the environment. When new system-level objects appear—such as binaries, configuration files, or key directories—it could be legitimate software installation or, potentially, malicious activity aiming to introduce malware. When such objects are removed or renamed, it can signal tampering, data destruction, or attempts to evade security controls. Capturing both creation and deletion provides a complete audit trail of the life cycle of important assets, supporting incident investigation, change management, and PCI DSS logging requirements.

In practice, you enable appropriate OS or security tooling to record who performed the action, when it happened, where it occurred, and exactly which object was affected, with centralized collection for monitoring and alerting. If you logged only one side—either creation or deletion—you would miss important signals: a deleted critical file might go unnoticed, or a newly created, potentially dangerous object might not be flagged. Not logging at all is not aligned with PCI DSS expectations for monitoring and maintaining the integrity of system components.