A token was used to access an organization's resource via API. What fields in the audit log help determine who used it?

Question

Options

• AThe token's permissions and the geographic region of access
• BThe token expiration date
• CThe GitHub Actions runner name
• DThe token ID, requesting IP address, and associated user

• A
  8% (2)
• B
  4% (1)
• D
  88% (22)

Explanation

Option D is correct because audit logs are designed to answer who, what, when, and from where - the token ID identifies which credential was used, the requesting IP address shows the origin of the request, and the associated user ties the action to a specific identity, giving investigators a complete attribution trail.

Option A is wrong because permissions describe what a token can do, not who used it - and geographic region is a derived inference, not a standard audit log field. Option B is wrong because an expiration date tells you when a token becomes invalid, which is lifecycle metadata, not attribution data. Option C is wrong because a GitHub Actions runner name is specific to CI/CD pipeline context and wouldn't appear in a general organization API audit log.

Memory tip: Think of audit logs like a security camera receipt - you need the badge number (token ID), the door it came from (IP address), and whose badge it is (associated user). Permissions and expiry are badge settings, not badge usage.

No community discussion yet for this question.