CRISC · Question #576
Which of the following is the PRIMARY reason for logging in a production database environment?
The correct answer is A. To provide evidence of activities. The primary reason for logging in a production database environment is to create an immutable record that provides evidence of all activities for audit trails, incident investigation, and accountability.
Question
Which of the following is the PRIMARY reason for logging in a production database environment?
Options
- ATo provide evidence of activities
- BTo prevent illicit actions of database administrators (DBAs)
- CTo ensure that changes are authorized
- DTo ensure that changes made are correctly applied
How the community answered
(42 responses)- A95% (40)
- B2% (1)
- D2% (1)
Why each option
The primary reason for logging in a production database environment is to create an immutable record that provides evidence of all activities for audit trails, incident investigation, and accountability.
Logging creates an auditable trail of events, including successful and failed logins, data modifications, and administrative actions. This evidence is crucial for security monitoring, forensic investigations after a breach, compliance audits, and establishing accountability for actions performed within the database.
While logging can help deter illicit actions and identify them, its primary purpose is to provide the evidence necessary for accountability and investigation, not solely prevention.
Logging records what happened, which can later be used to verify authorization, but it doesn't ensure authorization at the time of the action itself.
Logging records changes, but it doesn't ensure they are correctly applied; that's a function of data integrity checks and testing.
Concept tested: Primary purpose of database logging
Source: https://learn.microsoft.com/en-us/azure/azure-sql/database/audit-overview
Topics
Community Discussion
No community discussion yet for this question.