A recent incident revealed a log entry was modified alter its original creation. Which of the following technologies would BEST ensure end user systems are able to defend against future incidents?

Question

Options

• AUse an offline archival server
• BDeploy MFA for access to services.
• CImplement a blockchain scheme.
• DEmploy a behavioral HIDS on end user devices.

• A
  81% (26)
• B
  9% (3)
• C
  3% (1)
• D
  6% (2)

Explanation

To defend against log tampering after creation, using an offline archival server is the most effective defense for end-user systems. Logs are forwarded from live systems to an offline (air-gapped or network-isolated) archive immediately upon generation. Once transferred, an attacker who compromises the production environment cannot reach the archive server to modify those logs, effectively making the archived copies immutable from the attacker's perspective. MFA (B) protects access but doesn't prevent a privileged attacker from modifying logs. Blockchain (C) provides cryptographic tamper-evidence but is more complex and less proven in typical enterprise deployments. Behavioral HIDS (D) detects intrusion but does not directly protect log integrity. The offline archival approach addresses the root cause by removing the logs from the attacker's reachable environment.

No community discussion yet for this question.