212-89: EC-Council Certified Incident HandlerDemo

By ECCouncil · Question Mode

QuestionQ136

Forensic Readiness and First Response

An audit trail policy collects audit trails, such as sequences of records of computer events relating to an operating system, application, or user activities. Which of the following statements is NOT true about an audit trail policy:

  • A It helps calculating intangible losses to the organization due to incident
  • B It helps tracking individual actions and allows users to be personally accountable for their actions
  • C It helps in compliance to various regulatory laws, rules,and guidelines
  • D It helps in reconstructing the events after a problem has occurred
Explanation

Audit trails provide records that support individual accountability, regulatory compliance, and reconstruction of events after a problem or incident. Calculating an organization’s intangible losses from an incident is a business-impact or risk-analysis activity, not a function of an audit trail policy.

Community Discussion

No comments yet. Be the first to start the discussion!