Daily review must include logs of all system components that store, process, or transmit CHD and/or SAD.

Daily review must include logs of all system components that store, process, or transmit CHD and/or SAD.

• A. Logs of all system components that store, process, or transmit CHD and/or SAD
• B. Only servers with security roles
• C. Only network devices
• D. Only endpoints

Answer: (A)

You must monitor and review logs from every component that stores, processes, or transmits cardholder data or sensitive authentication data every day. The reason this is the best choice is that any part of the environment that handles CHD/SAD could be involved in an intrusion or data exposure, and limiting reviews to just servers or just network devices leaves blind spots. PCI DSS requires continuous monitoring and daily review of access and activity around cardholder data, with logs that can be correlated across the entire scope. By including logs from all relevant components—servers, network devices, endpoints, storage gateways, and any payment-processing elements—you get a complete, auditable trail that supports timely detection, investigation, and response. Limiting the review to a subset misses potential events and undermines the objective of comprehensive monitoring.

You must monitor and review logs from every component that stores, processes, or transmits cardholder data or sensitive authentication data every day. The reason this is the best choice is that any part of the environment that handles CHD/SAD could be involved in an intrusion or data exposure, and limiting reviews to just servers or just network devices leaves blind spots. PCI DSS requires continuous monitoring and daily review of access and activity around cardholder data, with logs that can be correlated across the entire scope. By including logs from all relevant components—servers, network devices, endpoints, storage gateways, and any payment-processing elements—you get a complete, auditable trail that supports timely detection, investigation, and response. Limiting the review to a subset misses potential events and undermines the objective of comprehensive monitoring.