Which statement correctly describes OS logs' security-related information?

Which statement correctly describes OS logs' security-related information?

• A. Operational actions only
• B. No security info
• C. Only machine metrics
• D. Security event information via audit logs

Answer: (D)

OS logs provide security-relevant information by recording events that show what happened on the system, who did it, when it occurred, and with what privileges. The statement about security event information via audit logs is the best description because audit subsystems are specifically designed to capture security-critical activities—such as authentication attempts, privilege changes, file access, and policy or configuration changes. This creates an auditable trail essential for forensic analysis, incident response, and compliance. While logs can include operational actions or general system metrics, they are not limited to those. They do contain security data, and the audit-focused records are what make it possible to understand and investigate security-related events.

OS logs provide security-relevant information by recording events that show what happened on the system, who did it, when it occurred, and with what privileges. The statement about security event information via audit logs is the best description because audit subsystems are specifically designed to capture security-critical activities—such as authentication attempts, privilege changes, file access, and policy or configuration changes. This creates an auditable trail essential for forensic analysis, incident response, and compliance.

While logs can include operational actions or general system metrics, they are not limited to those. They do contain security data, and the audit-focused records are what make it possible to understand and investigate security-related events.