For audit trails, which entry must be recorded to identify the kind of event that occurred on system components?

For audit trails, which entry must be recorded to identify the kind of event that occurred on system components?

• A. Type of event is included in log entries
• B. Host's current user name
• C. File name being accessed
• D. Network protocol in use

Answer: (A)

In audit trails, you identify what happened by recording the type of event. The event type labels the action that occurred (for example, login attempt, file access, configuration change, error, etc.), which lets you quickly categorize and analyze security activity across systems. Without an explicit event type, other data like which user performed an action or which file was involved only provides context and may not reveal what kind of event occurred. For instance, knowing a user accessed a file doesn’t tell you whether the action was a read, write, or delete. The event type is the key identifier that reveals the exact kind of event, enabling effective monitoring and incident response.

In audit trails, you identify what happened by recording the type of event. The event type labels the action that occurred (for example, login attempt, file access, configuration change, error, etc.), which lets you quickly categorize and analyze security activity across systems. Without an explicit event type, other data like which user performed an action or which file was involved only provides context and may not reveal what kind of event occurred. For instance, knowing a user accessed a file doesn’t tell you whether the action was a read, write, or delete. The event type is the key identifier that reveals the exact kind of event, enabling effective monitoring and incident response.