What mechanism should be used on logs to detect and alert on changes to existing data?

• A. Examine system settings, monitored files, and results from monitoring activities to verify the use of file-integrity monitoring or change-detection software on logs.
• B. Regular backups only.
• C. No monitoring.
• D. Encryption-only controls.

Answer: (A)

Detecting changes to log data relies on file integrity monitoring or change-detection software that watches log files (and their attributes) for edits, deletions, or permission changes and raises alerts when a modification occurs. This kind of monitoring provides real-time visibility into tampering, which is essential for maintaining the integrity of logs used as evidence during investigations. By verifying that such a mechanism is in place and actively reporting alerts, you ensure that any attempt to alter logs is detected promptly. Regular backups protect data after changes but don’t provide immediate detection or alerting, encryption-only controls don’t reveal tampering, and having no monitoring clearly misses tampering events.