When a security violation occurs, what important information should be logged? (Choose all that apply)

The correct answer is A. User ID B. Timestamp D. Computer / Terminal ID. When a security violation occurs, crucial information such as User ID, Timestamp, and Computer / Terminal ID should be logged to aid in forensic investigation and auditing.

Submitted by akirajp· Apr 18, 2026Incident Response and Recovery

Question

Options

AUser ID
BTimestamp
CUser's first and last name
DComputer / Terminal ID
EAll of the items listed

How the community answered

(48 responses)

A
94% (45)
C
4% (2)
E
2% (1)

Why each option

When a security violation occurs, crucial information such as User ID, Timestamp, and Computer / Terminal ID should be logged to aid in forensic investigation and auditing.

AUser IDCorrect

BTimestampCorrect

CUser's first and last name

While potentially useful, logging a user's full first and last name might be considered excessive for a basic security log and could raise privacy concerns, especially compared to the critical technical identifiers.

DComputer / Terminal IDCorrect

EAll of the items listed

This choice is incorrect because the user's first and last name (C) is generally not considered an essential piece of information for initial logging compared to the other technical identifiers, thus 'all of the items listed' is false.

Concept tested: Essential security logging information

Source: https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/security-logging-monitoring

Topics

#Security logging#Incident response#Event logging#Forensic data

Community Discussion

No community discussion yet for this question.

Full SSCP Practice