Why is monitoring and logging important for security?

• A. Logs are optional; privacy ignored.
• B. Monitoring and logging support incident detection, post-incident analysis, and compliance.
• C. To slow down systems.
• D. For aesthetics.

Answer: (B)

Monitoring and logging provide the visibility needed for security by enabling real-time detection of incidents, thorough post-incident analysis, and evidence for regulatory and policy compliance. Logs capture authentication attempts, file changes, network connections, and process activity, so you can spot anomalies like unusual login times, repeated failed attempts, or unexpected privilege use, and then reconstruct the sequence of events to understand what happened. Centralized, tamper-evident logs support correlating activity across systems, feeding into analysis tools and alerts that shorten response time. They also create an auditable trail that demonstrates controls were in place and followed, which is essential for compliance with laws and standards. Because logs may contain sensitive data, they should be protected with proper access controls, encryption, and retention policies.