Which combination of activities is recommended to validate the existence of automated audit trails across system components?

• A. Complete interviews of responsible personnel, observation of audit logs, and examination of audit log settings.
• B. Implementing only centralized log storage without verifying personnel.
• C. Reviewing annual security policy without logs.
• D. Disabling some logs to reduce overhead.

Answer: (A)

The main idea here is proving that automated audit trails exist, are generated across all system components, and are configured correctly. The strongest approach combines three sources of evidence: interviews with the people responsible for logging, which confirms awareness, ownership, and the expected logging practices; direct observation of actual audit logs to show that logs are being created and collected across components; and a review of the audit log settings to verify that the right events are captured, logs are preserved, and protection measures are in place. Together, these show not only that logs exist, but that they are active and properly configured, which is essential for reliable auditing and monitoring. Relying on centralized storage alone doesn’t prove logs exist across every component or that personnel are following logging practices; reviewing policies without logs offers no evidence of actual logging; and disabling logs defeats the purpose of having audit trails.