CISSP Security Assessment and Testing Practice Question
A security analyst is reviewing logs from multiple systems and needs to ensure that logs are tamper-proof and available for incident investigation. Which of the following is the BEST approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Centralize logs to a syslog server with cryptographic hashing and append-only access
Centralized log management with write-once, read-many (WORM) storage ensures log integrity and availability for investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a cloud storage bucket with public read access
Why it's wrong here
Granting public read access to a cloud storage bucket directly violates the principle of confidentiality, making sensitive log data accessible to unauthorized individuals globally. This exposure could lead to severe data breaches, regulatory non-compliance, and reputational damage. Furthermore, while read-only, the public visibility could allow attackers to gather intelligence for future attacks, indirectly impacting integrity by revealing system vulnerabilities or configurations.
- ✗
Store logs locally on each system with restricted permissions
Why it's wrong here
Storing logs locally on each system, even with restricted permissions, creates a significant risk because a successful compromise of that specific system often grants the attacker sufficient privileges to tamper with or delete the local log files. This allows an adversary to erase their forensic trail, hindering incident response and post-incident analysis. Effective security monitoring requires logs to be protected from the very systems they monitor.
- ✗
Encrypt logs at the source and send via email to the security team
Why it's wrong here
While encrypting logs at the source is a good practice for confidentiality, sending them via email is fundamentally insecure and unreliable for log transport. Email protocols (like SMTP) are not designed for secure, high-volume, or guaranteed delivery of sensitive data, making logs susceptible to interception, loss, or delayed delivery. Furthermore, email systems lack robust mechanisms for ensuring log integrity, non-repudiation, or centralized management, which are critical for effective security analysis.
- ✓
Centralize logs to a syslog server with cryptographic hashing and append-only access
Why this is correct
Centralizing logs to a dedicated syslog server significantly enhances security by providing a single, hardened repository for all audit data, making it easier to monitor and analyze. Cryptographic hashing ensures the integrity of each log entry, detecting any unauthorized modifications or tampering attempts after creation. Combined with append-only access, which prevents deletion or alteration of historical records, this approach provides a robust, forensically sound audit trail critical for incident response and compliance.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.