Which requirement ensures actions taken by root or administrative privileges are logged?

• A. Verify all actions taken by any individual with root or administrative privileges are logged.
• B. Verify only login events are logged.
• C. Verify non-privileged user activity is logged.
• D. Verify no privileged accounts are monitored.

Answer: (A)

The main idea is ensuring privileged activity is auditable for accountability and security. When someone has root or administrative access, their actions can have a large impact on systems and data, so every action they take should be logged to create a verifiable trail of who did what, when, and from where. This supports detecting misuse, validating that changes are authorized, and meeting PCI DSS expectations around monitoring access to critical resources.

Logging only login events misses what happens after login—for privileged users, the commands run, configurations changed, files accessed, and other actions are what matter. Logging non-privileged user activity doesn’t cover privileged accounts, which are the focus here. And not monitoring privileged accounts at all would leave a critical blind spot, defeating the purpose of thorough auditing.