What must be logged to reconstruct access to all audit trails?

• A. Verify the creation of new users is logged.
• B. Verify access to all audit trails is logged.
• C. Verify system clock synchronization is logged.
• D. Verify only read access to audit trails is logged.

Answer: (B)

To reconstruct access to all audit trails, you must log every access to the audit trails themselves. This creates a record of who viewed, modified, or otherwise interacted with the logs and when those actions occurred, which is essential for tracing and verifying events after the fact. Without logging access to the audit trails, you can’t reliably determine who retrieved or tampered with logs, undermining the ability to rebuild the sequence of actions. Other items like logging user creation or clock synchronization are helpful for broader security and timing, but they don’t by themselves provide the necessary visibility into who accessed the audit trails. And logging only read access would miss other critical actions such as writes or deletions that could affect log integrity.