Which item is a required audit trail entry to identify the specific type of event?

Which item is a required audit trail entry to identify the specific type of event?

• A. Type of event
• B. User's login time
• C. Data size
• D. Timestamp

Answer: (A)

Auditors need to know what action occurred, not just when it happened. The item that best identifies the exact action logged is the type of event, because it labels the specific activity (for example, a login attempt, access to data, or a modification). A timestamp helps place the event in time, but it doesn’t describe what happened. A user’s login time points to when a login occurred, not what kind of event it was. Data size isn’t a universal indicator of the event type either. In PCI DSS audit logs, recording the type of event alongside the timestamp and user allows you to clearly understand what happened.

Auditors need to know what action occurred, not just when it happened. The item that best identifies the exact action logged is the type of event, because it labels the specific activity (for example, a login attempt, access to data, or a modification). A timestamp helps place the event in time, but it doesn’t describe what happened. A user’s login time points to when a login occurred, not what kind of event it was. Data size isn’t a universal indicator of the event type either. In PCI DSS audit logs, recording the type of event alongside the timestamp and user allows you to clearly understand what happened.