Which combination of verification steps is recommended during PCI DSS compliance assessment for audit trails?

• A. Only automated reports.
• B. Complete interviews, observation of audit logs, and examination of audit log settings.
• C. Rely on external audits alone.
• D. Focus only on privileged accounts.

Answer: (B)

Verifying audit trails effectively requires a blend of people, processes, and system configurations. Interviews with staff reveal who is responsible for logs, how logs are reviewed, and what the incident response process looks like, confirming that the organization actually follows its logging policy. Observing audit logs in action shows that logs are being generated, collected, and monitored in real time, so you’re not just taking paperwork at face value. Examining audit log settings verifies the technical details: which events are captured, how logs are protected and retained, time synchronization, and controls that prevent tampering. Relying solely on automated reports, external audits, or a narrow focus on privileged accounts would miss gaps in configuration, day-to-day operation, and coverage of key events. This combined approach gives a complete picture of how audit trails are created, maintained, and used for security monitoring.