Why is immutable log storage important in security monitoring?

• A. It allows logs to be edited for accuracy.
• B. It reduces storage requirements.
• C. It enables faster log retrieval.
• D. It prevents tampering with log records after they are written.

Answer: (D)

In security monitoring, logs must be tamper-evident, meaning once a log entry is written it cannot be altered or deleted without leaving detectable evidence. This immutability is crucial because logs serve as the definitive record of what happened, who did what, and when. If logs could be edited after the fact, an attacker could erase traces, modify events, or insert false entries, making it impossible to accurately detect breaches, investigate incidents, or prove compliance. An immutable, append-only storage or tamper-evident mechanism preserves the integrity of the entire history, enabling reliable incident response, forensics, and audits.

That’s why preventing tampering after writing is the best description of why immutable log storage matters. It’s not primarily about reducing storage or speeding retrieval, and immutability doesn’t inherently change how fast you can access logs.