Given this concern, and the need to keep archived logs for log correction applications, what is the most appropriate next steps?

Beta corporation is doing a core evaluation of its centralized logging capabilities. The security staff suspects that the central server has several log files over the past few weeks that have had their contents changed.

Given this concern, and the need to keep archived logs for log correction applications, what is the most appropriate next steps?
A . Keep the files in the log archives synchronized with another location.
B . Store the files read-only and keep hashes of the logs separately.
C . Install a tier one timeserver on the network to keep log devices synchronized.
D . Encrypt the log files with an asymmetric key and remove the cleartext version.

View Answer

Answer: B