Which feature enhances the tamper-evidence of audit trails?

• A. Regular backups
• B. Versioned backups
• C. Access controls
• D. Immutable logs with cryptographic signing

Answer: (D)

Tamper-evidence in audit trails comes from making the logs unchangeable and verifiable. Immutable logs ensure entries are append-only, so they cannot be altered or deleted after being written. Cryptographic signing binds each entry (or the log as a whole) with a verifiable signature and timestamp, so any modification breaks the signature or the hash chain. This combination lets you detect even subtle tampering and proves the integrity and origin of the records.

Regular backups don’t stop someone from altering logs; they simply provide copies for recovery. Versioned backups preserve history but don’t inherently expose post-write changes in the current logs. Access controls help prevent unauthorized edits but don’t provide a mechanism to verify past integrity after the fact.