Regarding audit logs, which statement best describes how they should be protected and accessible?

• A. Logs Should Be Tamper-Evident And Encrypted
• B. Logs Are Optional And May Be Archived
• C. Logs Should Be Tamper-Evident, Encrypted, Retained Per Policy, And Accessible To Auditors
• D. Logs Can Be Deleted After A Year

Answer: (C)

Audit logs must be protected to preserve integrity, confidentiality, retention, and usefulness for audits. They should be tamper-evident so any modification or removal is detectable, ensuring the record remains trustworthy. They should also be encrypted to protect the data from exposure if storage or transit is compromised. Logs should be retained according to policy so you keep them long enough to meet regulatory requirements and support investigations, and they should be accessible to authorized auditors so independent verification can occur. In contrast, treating logs as optional, or allowing deletion after a fixed period, or denying access to auditors, fails to provide a reliable, verifiable trail and undermines accountability.