Which items must be logged regarding the lifecycle of audit logs?

• A. Initialization of audit logs.
• B. Stopping of audit logs.
• C. Pausing of audit logs.
• D. Initialization of audit logs and stopping or pausing of audit logs.

Answer: (D)

Auditing must capture changes to the logging process itself to maintain a trustworthy record. If logging starts, you establish a baseline of what will be collected; if logging is stopped or paused, events occurring during that period could be missed unless that change is logged. Recording both the initialization and any stopping or pausing of audit logs creates a complete timeline of when logging was active, helps detect gaps or tampering, and supports forensics and compliance. The other options only cover partial aspects and miss either the start or the pause state, so they don’t provide the full, auditable picture of the logging lifecycle.