Event Log Aggregation System Risk Management
Short answer
A Completeness testing has not been performed on the log data.
Question
Key Takeaways
This question tests the auditor's ability to prioritize data integrity and availability (completeness) over data confidentiality (encryption) when reviewing log systems for risk management purposes.
The question addresses risk management in event log aggregation systems, where community consensus identifies completeness testing as the primary concern over encryption or formatting issues.
Common mistake: Many candidates choose D (Encryption) because they associate security primarily with confidentiality. However, if logs are incomplete, forensic analysis and compliance reporting become impossible, representing a higher operational risk.
Expert Analysis
Why the Answer Is Correct
Completeness is the foundational requirement for any audit trail or log aggregation system. If log data is missing due to failures in collection or transmission, the organization loses visibility into security events, making it impossible to detect incidents or prove compliance. Without complete data, other controls like encryption are moot because there is no reliable record to protect.
Why the Other Options Are Wrong
While data encryption (D) protects confidentiality, it does not ensure that the logs exist or are accurate. Batch processing (B) is a valid technical method and not inherently risky unless latency requirements are violated. Non-normalized data (C) may affect analysis efficiency but does not compromise the existence or integrity of the log records themselves.
Community Comment Notes
Comments highlight the tension between confidentiality and integrity. While some users argue for encryption (D), others correctly point out that logs fall under the integrity category of security. The consensus emphasizes that without completeness, the log system fails its primary purpose: providing a reliable history of events.
Official Reference
Array
This link opens the official vendor documentation in a new tab.
Exam Strategy
When auditing log systems, always prioritize the 'Availability' and 'Integrity' of the data first. Ask yourself: 'Can we even see the events?' before asking 'Are the events protected?'. Completeness is a prerequisite for all other security functions.
Frequently Asked Questions
Why is completeness more important than encryption for logs?
Does batch processing pose a risk to log integrity?
Community Votes
67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 5 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 5
-
Sibsankar 👍 2Data encryption is crucial for protecting sensitive information contained within the event logs. If encryption standards have not been considered or implemented, it poses a significant risk to the confidentiality and integrity of the log data. Unauthorized access or tampering could occur, leading to potential breaches or manipulation of critical information. The best answer is D
-
Sibsankar 👍 2D is wrong A is the right answer.
-
Swallows 👍 1 Answered AOf the three categories of information security, confidentiality, integrity, and availability, logs fall into the integrity category.
-
Swallows 👍 1 Answered AData encryption is important, but ensuring integrity is a fundamental security requirement.
-
EC123 👍 1 Answered DI though encryption is very important to ensure the log data is not being modified.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →