Which security function logs are included for daily review under 10.6.1?

Which security function logs are included for daily review under 10.6.1?

• A. End-user devices
• B. Firewalls, IDS/IPS, authentication servers, e-commerce redirection servers, and other security function components
• C. Printers and copiers
• D. Database logs only

Answer: (B)

The main idea here is that daily log reviews under this PCI DSS control focus on security-relevant devices and systems that monitor and control access to the cardholder data environment. Logs from these security function components provide visibility into potential breaches, policy violations, and configuration issues, helping you detect suspicious activity quickly. The best answer reflects the devices that actively monitor and enforce security boundaries: firewalls, IDS/IPS, authentication servers, e-commerce redirection servers, and other security function components. These sources generate critical event data such as blocked traffic, intrusion alerts, login successes and failures, access-control changes, and other security-relevant events. Regularly reviewing their logs daily ensures you catch anomalies and respond promptly. Logs from end-user devices, printers, or copiers aren’t the primary focus for this daily security-log review in the same way. While database logs can be important, relying on database logs alone would miss the broader picture of activity across the security boundary and key control points. The emphasis here is on the security perimeter and authentication/control components that directly affect the protection of cardholder data.

The main idea here is that daily log reviews under this PCI DSS control focus on security-relevant devices and systems that monitor and control access to the cardholder data environment. Logs from these security function components provide visibility into potential breaches, policy violations, and configuration issues, helping you detect suspicious activity quickly.

The best answer reflects the devices that actively monitor and enforce security boundaries: firewalls, IDS/IPS, authentication servers, e-commerce redirection servers, and other security function components. These sources generate critical event data such as blocked traffic, intrusion alerts, login successes and failures, access-control changes, and other security-relevant events. Regularly reviewing their logs daily ensures you catch anomalies and respond promptly.

Logs from end-user devices, printers, or copiers aren’t the primary focus for this daily security-log review in the same way. While database logs can be important, relying on database logs alone would miss the broader picture of activity across the security boundary and key control points. The emphasis here is on the security perimeter and authentication/control components that directly affect the protection of cardholder data.