ISC2 CC Security Operations Practice Question
A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?
⚠ Common exam trap
The trap is equating encryption or read-only access with integrity; only write-once/immutable storage actually prevents post-write modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing write-once storage for log files
Write-once storage (WORM) physically prevents modification or deletion of log data after it is written, which is the strongest guarantee of log integrity. Because the media enforces immutability at the storage layer, even a compromised application or administrator cannot alter historical records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storing logs on the same server as the application
Why it's wrong here
Same-server storage leaves logs writable by anyone with application or host access, so tampering remains possible. The correct approach ships logs to a separate hardened or write-once store. Co-location suits convenience and low latency, not integrity.
- ✗
Using a separate log server with read-only access
Why it's wrong here
Read-only access controls who may write to the log server, but an attacker with administrative or storage-level rights can still modify or delete entries; it provides no cryptographic tamper evidence. It is tempting because restricting write permissions is a genuine hardening step for log servers, and would be reasonable where only casual alteration by ordinary users is the concern.
- ✓
Implementing write-once storage for log files
Why this is correct
Write-once storage enforces immutability at the media or object layer, so once log data is written it cannot be modified or overwritten, even by compromised accounts. This directly satisfies the stem's requirement that log data cannot be altered after being written.
- ✗
Encrypting logs with a symmetric key
Why it's wrong here
Symmetric encryption protects confidentiality in transit or at rest, but anyone holding the key can decrypt, alter and re-encrypt, leaving no tamper evidence. The correct method uses append-only or write-once storage with hashing. Encryption suits protecting sensitive log contents from disclosure.
Go deeper
Related to this question
Key term
Worm
A worm is a type of malicious software that can copy itself and spread to other computers over a network, often without any human action.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.