Which aspects should be examined to verify the use of file-integrity monitoring or change-detection software on logs?

• A. Results from monitoring activities.
• B. System settings, monitored files, and results from monitoring activities.
• C. Only the presence of monitoring agents.
• D. Audit logs themselves.

Answer: (B)

Verifying file-integrity or change-detection on logs requires a holistic view of how the monitoring is set up, what it watches, and what it reports. Start with the system settings: this shows how the monitoring tool is configured—what directories or file patterns are included, what hash or comparison method is used, how often checks run, and how alerts are generated. Without clear settings, you can’t confirm the tool is actually watching the right logs or behaving as intended.

Next, confirm the list of monitored files themselves. This shows which logs are under watch and ensures that critical log files are included, not accidentally excluded. It’s possible to have a monitoring agent installed but not configured to cover the relevant logs, so the file list is essential evidence.

Finally, look at the results from monitoring activities. These provide concrete evidence that checks are occurring, any changes detected, and how tampering or unexpected modifications are handled. This demonstrates ongoing effectiveness and the ability to detect integrity violations.

Why the other options don’t fully fit: focusing only on results omits what is being watched and how it’s configured; checking only for the presence of monitoring agents confirms nothing about scope or operation; and relying on audit logs alone doesn’t prove that a file-integrity tool is configured or actively monitoring the log files.