CompTIA CASP+ Practice Test

Which control is most effective in monitoring user and administrator activities in a system?

1. Periodic manual reviews

2. Automated audit logging

3. Ignoring user activities

4. Monthly team meetings

The correct answer is: Automated audit logging

Automated audit logging is the most effective control for monitoring user and administrator activities in a system because it continuously records actions taken within the system, providing a comprehensive and accurate account of user interactions. This method captures data such as login attempts, changes made to files or configurations, and access to sensitive information, creating a reliable trail that can be analyzed later for compliance and security purposes. Unlike periodic manual reviews, which are limited by the frequency of the review and may miss critical events that occur outside of the review period, automated logging ensures that all activities are captured in real-time, making it easier to identify suspicious behaviors or potential security breaches. Additionally, automated logs can help streamline compliance with regulations that require detailed activity records. Other options, such as ignoring user activities, would completely negate the monitoring process and leave the system vulnerable to misuse. Monthly team meetings may include discussions about activities but are not a systematic method for monitoring individual actions within the system. This makes automated audit logging superior in effectiveness for ongoing, detailed oversight.