Be able to determine later who deleted a virtual machine and when.
Which countermeasure is effective?
Enable audit logs for management APIs and consoles and preserve them in a tamper-resistant location with individual accounts.
Detailed explanation
Incorrect. A shared administrator account prevents attribution.
Incorrect. Logs stored only on a temporary instance disk may disappear with the instance.
Incorrect. Omitting deletion logs fails the traceability requirement.
Correct. Recording the actor, time, and operation supports later investigation.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'actor, time, action, and resource are auditable'Expected result
actor, time, action, and resource are auditableKey points
- Audit log
- Individual accounts
- Log preservation
Notes
- Environment: クラウド監査の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Audit
Include administrative API and console operations in the audit scope.
Preservation
Use a destination, retention period, and access separation that prevent ordinary administrators from deleting the evidence.