Which artifact is most useful for establishing who accessed a system and when?

Which artifact is most useful for establishing who accessed a system and when?

• A. System/application logs and event timestamps
• B. Employee benefits records
• C. Network cables
• D. Printer ink levels

Answer: (A)

The main idea here is the audit trail—the record that shows who did what and when. System and application logs with event timestamps provide that trail for digital access. They log each authentication attempt, successful or failed, the user identity, the resources accessed, and the exact times those actions occurred. This makes it possible to reconstruct who accessed a system, from where, and in what order, which is essential for accountability and incident response. The timestamps help establish a precise timeline, and logs from different systems can be correlated to verify a user’s activity across the network. Other items don’t provide this access-by-time information. Employee benefits records track HR data, not system activity. Network cables indicate physical wiring or connectivity but don’t capture who accessed a system or when. Printer ink levels are unrelated to user actions within a system.

The main idea here is the audit trail—the record that shows who did what and when. System and application logs with event timestamps provide that trail for digital access. They log each authentication attempt, successful or failed, the user identity, the resources accessed, and the exact times those actions occurred. This makes it possible to reconstruct who accessed a system, from where, and in what order, which is essential for accountability and incident response. The timestamps help establish a precise timeline, and logs from different systems can be correlated to verify a user’s activity across the network.

Other items don’t provide this access-by-time information. Employee benefits records track HR data, not system activity. Network cables indicate physical wiring or connectivity but don’t capture who accessed a system or when. Printer ink levels are unrelated to user actions within a system.