Which of the following is the PRIMARY reason for selecting the appropriate level of detail for audit record generation?

While audit configuration can influence storage and processing costs, cost reduction throughout the SDLC is not the primary driver for selecting audit record detail levels; security and accountability requirements take precedence.

Root cause analysis (RCA) requires sufficiently detailed audit records to trace events back to their origin, identify contributing factors, and determine the sequence of actions that led to an incident. If audit records lack the right level of detail, investigators cannot reconstruct events accurately, making it impossible to identify the true cause of a failure or breach. Appropriate granularity ensures that audit logs capture enough contextual information-such as timestamps, user identities, and system states-to support thorough forensic investigation.

Corrective action reports are a downstream output of analysis, not the primary reason for determining audit record granularity; the detail level is set to enable the investigation that may eventually inform corrective actions.

Avoiding lengthy reports is a convenience consideration rather than a security or operational requirement, and it would actually argue for less detail, which could undermine the investigative value of audit records.