Which activity helps verify that audit trails are protected from alteration?

• A. Inspect the physical server hardware only
• B. Review firewall logs
• C. Run a network scan for vulnerabilities
• D. Interview system administrators and examine configurations and permissions to verify that audit trails are secured so that they cannot be altered

Answer: (D)

Audit trail integrity comes from who can access and change logs, and how those logs are stored and protected. The most reliable way to verify that audit trails cannot be altered is to examine the actual safeguards in place: the permissions and configurations controlling log creation and modification, where the logs are stored, and whether protective measures (like restricted write access, centralized/immutable storage, or cryptographic signing) are implemented. Interviewing system administrators and reviewing these configurations and permissions provides direct evidence of whether the audit trails are protected from tampering.

Inspecting physical hardware only may miss software-level controls that allow modification. Reviewing firewall logs looks at a different set of logs and doesn’t confirm protection of the audit trails themselves. A vulnerability scan checks for weaknesses but doesn’t prove that audit logs are safeguarded against alteration.