Access logs and audit trails

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does an access log record?

A Only the password each user typed in

B Who accessed a system or file, what they did and when

2. How is an access log created?

A Automatically by the system as people use it

B Only when a user remembers to write an entry by hand

3. A log shows 200 failed login attempts on one account in two minutes. What does this most likely suggest?

A Someone may be trying to guess the password

B The user is having a very successful day

4. Which log entry would help an administrator detect misuse?

A A student account opening the teachers' marks file at 3 am

B A teacher opening their own timetable at 9 am

5. How do access logs support accountability?

A They stop users from being able to do anything wrong

B They link actions to a specific user so people are responsible for what they do

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
12025-03-14 09:12 jsmith LOGIN FAILED		AA log entry that links a named user to an action on a file at a set time
22025-03-14 16:45 mlee DELETE grades.xlsx		B09:00 admin FAILED, 09:00 admin FAILED, 09:01 admin FAILED
3Using logs to detect misuse: a staff member opens files at 3 am when they never normally work then		CThe entry is missing the username and the time, so you can't tell who tried to log in or when
4Repeated failed logins in a short time can show someone guessing a password		D2025-03-15 03:02 tkhan OPEN payroll.csv
52025-03-14 LOGIN FAILED		EDeleting logs each night removes the evidence needed to spot misuse and hold users accountable
6Log setting: delete all logs every night		FA log entry showing a failed login attempt: the date and time, the user and the action

Definitions

access log

Fill in the Blanks

Complete each line of code by filling in the missing parts.

09:14 user=sam action=LOGIN ______

IF fails > 5 THEN _____ admin

who=mia what=DELETE grades.xlsx ____=14:03

___(user, "DELETE", now())

FOR EACH entry __ log IF entry.result = "FAILED" THEN count ← count + 1

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A OPEN access.log FOR APPEND

B OPEN access.log FOR OVERWRITE

C WRITE entry TO access.log

D CLOSE access.log

Question 2

A IF login = 'FAIL' THEN

B LOG 'failed login', user

C attempts ← attempts - 1

D IF attempts >= 3 THEN LOCK

Question 3

A entry.time ← 'unknown'

B entry.user ← currentUser

C entry.action ← 'opened file'

D WRITE entry TO audit.log

Question 4

A FOR each entry IN access.log

B IF entry.hour < 6 THEN

C DELETE entry

D END IF

E END FOR

Question 5

A IF login.result = 'PASS' THEN

B WRITE user, NOW() TO log

C END IF

Answer Key

Access logs and audit trails

Section A: Quick Questions

B — Who accessed a system or file, what they did and when

A — Automatically by the system as people use it

A — Someone may be trying to guess the password

A — A student account opening the teachers' marks file at 3 am

B — They link actions to a specific user so people are responsible for what they do

Section B: Match the Pairs

2025-03-14 09:12 jsmith LOGIN FAILED → A log entry showing a failed login attempt: the date and time, the user and the action

2025-03-14 16:45 mlee DELETE grades.xlsx → A log entry that links a named user to an action on a file at a set time

Using logs to detect misuse: a staff member opens files at 3 am when they never normally work then → 2025-03-15 03:02 tkhan OPEN payroll.csv

Repeated failed logins in a short time can show someone guessing a password → 09:00 admin FAILED, 09:00 admin FAILED, 09:01 admin FAILED

2025-03-14 LOGIN FAILED → The entry is missing the username and the time, so you can't tell who tried to log in or when

Log setting: delete all logs every night → Deleting logs each night removes the evidence needed to spot misuse and hold users accountable

Section C: Definitions

access log — An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

Section D: Fill in the Blanks

09:14 user=sam action=LOGIN FAILED

IF fails > 5 THEN ALERT admin

who=mia
what=DELETE grades.xlsx
when=14:03

log(user, "DELETE", now())

FOR EACH entry IN log
IF entry.result = "FAILED" THEN
count ← count + 1

Section E: Spot the Error

B — An access log must keep its earlier records. It should be opened for APPEND so new entries are added to the end. OVERWRITE would erase the history.

C — Each failed login should add 1 to the counter, so it should be attempts + 1. Subtracting would stop the count from ever reaching 3, and repeated failed logins would go unnoticed.

A — A log entry records when something happened. The time must be set automatically with NOW(), not left as 'unknown'. Without a real time the log is much less useful.

C — Logs are used to detect misuse, so odd-hour access should trigger an ALERT for someone to review. Deleting the entry would destroy the evidence.

A — This program is meant to record failed login attempts. The condition should check for 'FAIL'. Checking for 'PASS' would log only successful logins and miss the failures.