Which of the following is required to support detection of unauthorized access attempts?

• A. Verify successful logins are logged.
• B. Verify invalid logical access attempts are logged.
• C. Verify password changes are logged.
• D. Verify all file deletions are logged.

Answer: (B)

Detecting unauthorized access attempts hinges on capturing failed authentication events. Logging invalid logical access attempts lets you notice patterns like repeated failed logins, unusual locations, or rapid lockouts, which are red flags that someone is trying to break in. This focus on failed attempts enables timely detection and response to brute-force or credential-stuffing activity.

Logging successful logins is still useful for auditing and incident investigation, but it doesn’t reveal attempts that were blocked or failed before access was granted. Password-change events track credential management after access, not the attempts themselves. File deletion logs relate to data handling and integrity, not login attempts. Keeping a record of failed authentication attempts directly supports monitoring and detecting unauthorized access, aligning with PCI DSS monitoring requirements.