Study. uk . com
  1. Home
  2. All questions
  3. Question 442

CISSP study material · question 442 of 500

Why does NIST SP 800-92 insist that log management functions leave the original logs unaltered?

  1. Because normalisation cannot be applied to files that have been modified.
  2. Because altering originals would break the rotation schedule.
  3. Because unaltered originals are what allow the logs to be used for evidentiary purposes.
  4. Because storage systems reject files whose size has changed after writing.
Show the answer

Answer: C. Because unaltered originals are what allow the logs to be used for evidentiary purposes.

SP 800-92 notes the functions are normally performed so that they do not alter the original logs, and that ensuring originals are unaltered supports their use for evidentiary purposes.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.2 footnote 23

Challenge yourself on this topic → Study as cards