How do logs support attribution in incident response?

• A. Provide evidence of attacker actions, timelines, and indicators of compromise; enable correlation across sources.
• B. Logs can prove attacker identity with certainty in all cases.
• C. Logs are deprecated in modern security practices.
• D. Logs are only useful for auditing internal expenses.

Answer: (A)

Logs are the trail that lets incident responders see what actually happened, when it happened, and who or what was involved. They document attacker actions, timelines, and indicators of compromise, and when you pull data from multiple sources—authentication logs, endpoint and application logs, network and firewall logs, DNS, and cloud logs—you can correlate events across systems. That cross-source correlation helps connect seemingly separate actions to a single actor or campaign, building a coherent timeline and supporting evidence-based attribution.

Think of logs as the evidence you use to answer: who logged in, from where, what commands or processes were started, what files were accessed or modified, and what network activity occurred. By aligning these events in time and mapping them to known attacker techniques and IOCs, you gain a clearer picture of the attack’s path and the actor behind it. Of course, logs aren’t perfect—they can be incomplete or tampered with, so proper logging hygiene, time synchronization, and data integrity measures are essential. The other statements don’t fit because logs don’t prove identity with certainty in all cases, they aren’t deprecated, and their value goes far beyond auditing internal expenses.