Which statement best describes what log data can help with security investigations?

• A. Log data can reveal when a specific event or error occurred
• B. Log data contains full user passwords
• C. Log data is irrelevant to application behavior
• D. Log data is only useful for billing

Answer: (A)

Logs provide a timeline of events that helps investigators reconstruct what happened during a security incident. Each log entry records something that occurred in the system along with a timestamp, such as a login attempt, access to a file, a service starting or stopping, an error, or a configuration change. That time-stamped sequence lets investigators place events in the correct order, see how a breach began, what actions followed, and which resources were affected. This temporal context is essential for understanding the scope of an incident, tracing attacker movements, and validating what happened.

It’s also important to recognize that security-friendly logging does not store full passwords; exposing secrets in logs is a major risk, so credentials and other sensitive data aren’t kept in plain form. Logs are used to observe behavior and security-relevant activity, not for billing purposes, and they should be maintained and protected to preserve their integrity for investigations.