What describes tamper-evident logging?

• A. Logs are protected from modification; uses append-only storage, hash chaining, and secure timestamps.
• B. Logs are stored in plaintext without security controls.
• C. Logs are rotated hourly with no integrity checks.
• D. Logs are deleted after 30 days regardless of policy.

Answer: (A)

Tamper-evident logging focuses on making it possible to detect any change to logs after they’re written. The strongest description involves protecting logs from modification by design, using an append-only storage model so new entries can be added but not overwritten, hash chaining so each entry includes a cryptographic link to the previous one, and secure timestamps to prove when each event occurred. Together, these mechanisms create a traceable, auditable record where any alteration breaks the chain or reveals tampering, making it readily detectable.

This approach provides integrity and accountability: if someone tries to alter an earlier entry, the hash chain won’t align, and the timestamping helps confirm that the sequence of events remains authentic. In contrast, storing logs in plaintext without security controls offers no protection against tampering, as someone could modify or delete data without triggering any checks. Rotating logs without integrity checks can conceal tampering if the rotation process isn’t itself protected or verifiable. Deleting logs after a set period removes evidence and breaks the ability to perform a complete audit.