Where should logs for external-facing technologies be written?

Where should logs for external-facing technologies be written?

• A. Do not log external-facing technologies
• B. Write logs for external-facing technologies onto a secure, centralized internal log server or media device
• C. Write logs to a public cloud bucket
• D. Print logs on paper only

Answer: (B)

The key idea is that logs from systems exposed to the outside world must be collected in a secure, centralized place you control, so you can reliably monitor, protect, and investigate security events. Writing logs for external-facing technologies to a secure, centralized internal log server or media device provides protected, auditable storage with controlled access, integrity protections, and retention aligned with policy and regulatory requirements. This setup makes it possible to correlate events across systems, detect anomalies, and perform forensics if needed. Logging to a public cloud bucket introduces external storage that may be harder to tightly control and audit, potentially creating gaps in protection and access management. Printing logs on paper is impractical for volume, searchability, and timely analysis, making it unsuitable for ongoing monitoring and incident response. Logging internal-facing systems only would miss the crucial need to capture events from external-facing technologies, which is precisely what needs to be monitored and retained.

The key idea is that logs from systems exposed to the outside world must be collected in a secure, centralized place you control, so you can reliably monitor, protect, and investigate security events. Writing logs for external-facing technologies to a secure, centralized internal log server or media device provides protected, auditable storage with controlled access, integrity protections, and retention aligned with policy and regulatory requirements. This setup makes it possible to correlate events across systems, detect anomalies, and perform forensics if needed.

Logging to a public cloud bucket introduces external storage that may be harder to tightly control and audit, potentially creating gaps in protection and access management. Printing logs on paper is impractical for volume, searchability, and timely analysis, making it unsuitable for ongoing monitoring and incident response. Logging internal-facing systems only would miss the crucial need to capture events from external-facing technologies, which is precisely what needs to be monitored and retained.