Which choice below is the BEST description of an audit trail?
A.
Audit trails are used to detect penetration of a computer system and to reveal usage that
identifies misuse.
B.
An audit trail is a device that permits simultaneous data processing of two or more security levels
without risk of compromise.
C.
An audit trail mediates all access to objects within the network by subjects within the network.
D.
Audit trails are used to prevent access to sensitive systems by unauthorized personnel.
Explanation:
An audit trail is a set of records that collectively provide documentary evidence of processing used to
aid in tracing from original transactions forward to related records and reports, and/or backward
from records and reports to their component source transactions. Audit trails may be limited to
specific events or may encompass all of the activities on a system. User audit trails can usually log:
All commands directly initiated by the user All identification and authentication attempts Files and
resources accessed It is most useful if options and parameters are also recorded from commands. It
is much more useful to know that a user tried to delete a log file (e.g., to hide unauthorized actions)
than to know the user merely issued the delete command, possibly for a personal data file. *Answer
“An audit trail is a device that permits simultaneous data processing of two or more security levels
without risk of compromise.” is a description of a multilevel devicE. A multilevel device is a device
that is used in a manner that permits it to process data of two or more security levels simultaneously
without risk of compromisE. To accomplish this, sensitivity labels are normally stored on the same
physical medium and in the same form (i.e., machine-readable or human-readable) as the data being
processed. *Answer “An audit trail mediates all access to objects within the network by subjects
within the network.” refers to a network reference monitor, an access control concept that refers to
an abstract machine that mediates all access to objects within the network by subjects within the
network. * Answer “Audit trails are used to prevent access to sensitive systems by unauthorized
personnel.” is incorrect, because audit trails are detective, and the answer describes a preventative
process, access control. Source: NCSC-TG-001 A Guide to Understanding Audit in Trusted Systems
and DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria.