Which events should be audited in a user account system, and how should the logs be protected?

• A. Password Reset Approvals Only
• B. Authentication Attempts, Privilege Changes, Group Membership Changes, Policy Violations
• C. Data Retention Logs
• D. Access Policy Creation Events

Answer: (B)

Auditing user account activity focuses on the events that reveal how authentication and authorization are being used and how security controls are being applied. The most important set to monitor includes authentication attempts (logins and failed attempts), privilege changes (granting or revoking elevated rights), group membership changes (shifts in access levels tied to roles), and policy violations (actions that breach security rules). This combination gives you visibility into who is trying to access systems, who gains or loses power within those systems, how role assignments evolve, and whether security policies are being followed. Together, these events help detect unauthorized access, track changes that could enable misuse, and provide the information needed for investigations and compliance.

Protecting the logs is essential to ensure they remain trustworthy and usable in investigations. Logs should be collected in a centralized, tamper-evident manner, often with append-only or WORM-like storage and cryptographic signing to detect and deter tampering. They must be encrypted both in transit and at rest, access-controlled with least privilege, and backed up to multiple locations to prevent loss. Regular reviews and real-time alerts on critical events should be set up to surface unusual activity quickly. Clear retention policies and integrity checks help ensure that the logs remain available and reliable when needed for audits or incident response.