Which of the following should be indicated in audit trails to show whether an event succeeded or failed?

• A. User's department
• B. The encryption algorithm used
• C. Success or failure indication
• D. The color of the screen

Answer: (C)

Indicate the outcome of the event. Audit trails must show whether an action actually completed or was blocked/errored, so a clear success or failure indication is essential. This directly lets you verify if a transaction, login, or access request, for example, happened as intended and supports investigations and compliance.

Other details you might see in logs, like the user's department, the encryption algorithm used, or non-operational data (such as screen color), do not convey the result of the action. They provide context or technical specifics, but they don’t tell you whether the event succeeded or failed.