Greatest Concern for Application Log Integrity?

Which of the following situations would cause the GREATEST concern around the integrity of application logs?

  1. Lack of a security information and event management (SIEM) system
  2. Lack of data classification policies
  3. Use of hashing algorithms
  4. Weak privileged access management controls Source Reference Answer

Community Votes

D
75%
A
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the understanding that while SIEM monitors logs, weak privileged access management actually enables the unauthorized modification or deletion of logs, which is the direct definition of an integrity failure.

Weak privileged access management controls pose the greatest risk to application log integrity by allowing authorized users to tamper with or delete logs without detection. The community consensus strongly identifies this as the primary vulnerability over the lack of a SIEM system.

Choosing A (Lack of SIEM) is a common mistake because students confuse monitoring tools with the root cause of data tampering, failing to realize that weak access controls allow the tampering to happen in the first place.

Community Discussion (4 comments)

Sara98 👍 1 Selected: D
If privileged access management controls are weak, it increases the risk that individuals with elevated permissions could alter, delete, or tamper with logs without detection. This poses a direct threat to the integrity of the logs, as unauthorized changes could go unnoticed.
efe6fee 👍 1 Selected: D
Logs may contain information that is sensitive or needed for forensic purposes, so they should be configured in ways that prevent alteration or deletion as well as preventing access by authorized personnel. In particular, they should be implemented in ways that prevent administrators with responsibility for systems or applications from altering or deleting logs made against their own scopes of responsibility. The risk practitioner should consider log access pennissions as part of evaluating the level of potential insider threat.
Bisibaby 👍 1 Selected: D
Strong privileged access control can ensure data integrity by limiting who has access to data.
Radko96 👍 1 Selected: A
It's not correct. D. Acces privileged controls the confidenciality, not the integrity. A SIEM (tracking changing logs) protect the integrity of the application.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Weak privileged access management (PAM) controls allow individuals with elevated permissions to alter, delete, or inject false data into application logs. If an administrator can modify logs to hide malicious activity, the fundamental integrity of the audit trail is destroyed. This represents a direct and severe threat to the non-repudiation and forensic value of the logs.

Why the Other Options Are Wrong

Option A is incorrect because while a SIEM aids in detecting integrity issues, its absence does not cause the tampering itself. Option B is incorrect because data classification pertains to sensitivity and handling requirements, not the fundamental immutability of log data. Option C is incorrect because hashing algorithms are a technical control specifically designed to verify and protect integrity, making their use a positive security measure rather than a risk.

Community Comment Notes

Comments highlight that weak PAM allows insiders to cover their tracks by deleting logs, emphasizing the need to prevent administrators from altering logs within their own scope. One dissenting comment suggested A, arguing PAM is for confidentiality, but the majority correctly identifies that limiting write access is the primary control for ensuring data integrity.

Exam Strategy

When answering questions about data integrity, focus first on who has the ability to modify the data. If access controls are weak, the data can be changed regardless of whether monitoring tools like SIEM are present.

Related Analysis

Which of the following is an example of risk sharing?

S-Grade

An organization has modified its disaster recovery plan (DRP

S-Grade

Management has implemented additional administrative and tec

S-Grade

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide