What do logging and monitoring support in security operations?

• A. Detection, incident response, and auditing
• B. User authentication only
• C. Data backup only
• D. Performance monitoring only

Answer: (A)

Logging and monitoring provide visibility into security events across systems, applications, and networks. That visibility is the backbone of security operations because it lets you see what happened, when, and by whom. With this, detection becomes possible: you can spot unusual patterns, failed logins, privilege changes, or data transfers that signal a potential issue. When something looks suspicious, you use that same information to guide incident response—tracing the incident, containing the threat, eradicating it, and restoring normal operations. The logs and the monitoring data also create an audit trail: a detailed record of access and activity that supports accountability, regulatory compliance, and post-incident analysis.

In short, logging and monitoring enable detecting incidents, guiding effective responses, and providing the auditability that security operations rely on. While they can touch areas like authentication events or general performance data, their primary value lies in visibility that supports detection, response, and auditing.