Which statement about 10.1 audit trails is correct?

• A. Audit trails must be enabled and active for system components and link access to individual users
• B. Audit trails are optional
• C. Audit trails only apply to file servers
• D. Audit trails can be disabled during off-hours

Answer: (A)

Auditing in PCI DSS is about capturing who did what and when, so you can reconstruct events and detect unauthorized activity. For the 10.1 area, the requirement is that audit trails are enabled and actively maintained on all system components and that access to those components is linked to individual users. This combination provides accountability and supports forensic analysis by showing exactly which user performed which action at a given time.

That’s why this statement is the best fit: it reflects both the need for enabled, ongoing logs across all components and the importance of tying those actions to specific user identities. It isn’t optional, it isn’t limited to file servers, and logs shouldn’t be disabled during off-hours—continuous, user-linked auditing is essential for effective monitoring and incident response.