Examkin

Question

Difficulty: MediumCIA Triad & Core Security Concepts

An enterprise systems administrator discovers that an attacker gained access to a database server and modified audit log files to erase evidence of unauthorized database queries. The administrator needs to select a security control that specifically ensures log files cannot be altered or tampered with without detection. Which of the following core security controls best maintains this specific pillar of the CIA triad?

  1. Implementing cryptographic hashing and digital signatures for generated log filesAnswer
  2. B
    Deploying Transport Layer Security encryption for syslog packet transport across network segments
  3. C
    Configuring dual redundant syslog collectors to accept log streams via UDP port 514
  4. D
    Restricting remote administration access by replacing Telnet on port 23 with SSH on port 22

Answer

Implementing cryptographic hashing and digital signatures for generated log files directly preserves data integrity, ensuring any modification or deletion of log entries is immediately detectable.
Generating cryptographic hashes and applying digital signatures ensures data integrity. Any unauthorized modification to audit logs changes the calculated hash value, making alterations immediately detectable.

Step-by-Step Solution

1
Analyze the threat scenario described in the stem.
The compromise involved unauthorized modification of log files, which directly violates the Integrity pillar of the CIA triad.
Integrity guarantees that data remains accurate, complete, and untampered with throughout its lifecycle.
2
Evaluate potential technical controls against the target security principle.
Cryptographic hashing algorithms generate a unique digest of data; if a log file is altered, the recalculated hash value will fail validation.
Hashing and digital signatures are the primary technical controls used to ensure data integrity and non-repudiation.

Key Concept

CIA Triad Integrity Controls
Rate this question

Topics

CIA Triad & Core Security Concepts

More questions from this topic