Where should audit trail files be backed up promptly to prevent alteration?

• A. Printed on paper and stored in a file cabinet.
• B. On a local hard drive.
• C. Promptly backed up to a centralized log server or media that is difficult to alter.
• D. To a public cloud bucket.

Answer: (C)

Backups of audit trail files must be kept in a tamper-evident, centralized location so you can detect alterations and preserve integrity for investigations and compliance. Promptly backing up to a centralized log server or to write-once media provides strong protection against tampering, supports consistent access controls, and makes it easier to verify and restore logs over time. Printing on paper introduces physical risk and delays; backing up to a local hard drive keeps data in the same potentially vulnerable system and lacks centralized tamper protection; a public cloud bucket can expose data through misconfigurations and broader access. Therefore, central, tamper-resistant backups are the most reliable choice.