While Investigating a Compromised Web Server, an Auditor Found That

Multiple Choice

While investigating a compromised Web server, an auditor found that the Web server logs had been deleted. The auditor should recommend that the Web server logs be:

A) Generated and maintained on a separate secure server.
B) Accessible by administrative users only
C) Encrypted to ensure that the logs cannot be deleted.
D) Restored automatically to the Web server from backup files.