Security & Compliance: Scenario-Based Questions

Audit logs provide a tamper-resistant trail of user actions and system events. They're essential for compliance (SOC 2, HIPAA, PCI), incident forensics, and trust — and must be designed with integrity and scale in mind.

📝 What to Log

• User logins, privilege changes, data access
• Admin operations (e.g., deletes, permission grants)
• System events like restarts or policy changes

🔐 Security Considerations

• Make logs append-only — no edits or deletions
• Use encryption at rest and in transit
• Apply digital signatures or hashing for tamper detection
• Restrict write access — no direct developer access

🛠️ Architecture Options

• Log collector agents (e.g., FluentBit, Filebeat)
• Write to Kafka, then to S3/Data Lake for durability
• Use cloud-native options (CloudTrail, Audit Logs, etc.)

📈 Querying & Retention

• Ship logs to queryable systems (e.g., OpenSearch, BigQuery)
• Index common fields (actor, timestamp, action)
• Apply tiered retention (e.g., hot for 7 days, cold for 1 year+)

✅ Best Practices

• Ensure clock sync (NTP) for accurate timestamps
• Tag logs with trace IDs for correlation
• Alert on high-risk actions (e.g., mass deletions)
• Review logs regularly during security audits

🚫 Common Pitfalls

• Logging sensitive data (e.g., passwords, tokens)
• Missing logs for “silent” privilege escalations
• Logs stored without redundancy or immutability

📌 Final Insight

Audit logs are not just a checkbox — they’re a security feature. A well-designed system captures what matters, preserves it safely, and surfaces insights when you need them most.