Which event types must be collected and monitored as part of audit trails?

Which event types must be collected and monitored as part of audit trails?

• A. Successful logical access attempts.
• B. Routine maintenance tasks.
• C. Network traffic flows.
• D. Invalid logical access attempts.

Answer: (D)

Auditing focuses on security-relevant events that reveal attempts to access sensitive data. The critical signal to monitor is invalid logical access attempts—failed login attempts. These failures often indicate attempted unauthorized access, such as brute-force or credential stuffing, and tracking them helps detect patterns, identify compromised accounts, and trigger timely responses. Routine maintenance tasks are legitimate administrative actions and can generate noise in audit trails if over-logged, while network traffic flows represent general activity rather than events tied to authentication to cardholder data. Successful logins are important to record, but they don’t by themselves signal a security threat; the failure to authenticate is the key indicator auditors monitor to detect potential breaches.

Auditing focuses on security-relevant events that reveal attempts to access sensitive data. The critical signal to monitor is invalid logical access attempts—failed login attempts. These failures often indicate attempted unauthorized access, such as brute-force or credential stuffing, and tracking them helps detect patterns, identify compromised accounts, and trigger timely responses. Routine maintenance tasks are legitimate administrative actions and can generate noise in audit trails if over-logged, while network traffic flows represent general activity rather than events tied to authentication to cardholder data. Successful logins are important to record, but they don’t by themselves signal a security threat; the failure to authenticate is the key indicator auditors monitor to detect potential breaches.