Which features characterize audit trails in a distributed CDX environment?

• A. Centralized, immutable logs with synchronized clocks; secure access to logs; tamper-evident storage and regular reviews.
• B. Decentralized logs with unsynchronized clocks and no reviews.
• C. Logs stored locally in each component with no central access control.
• D. Logs kept only for debugging and not reviewed routinely.

Answer: (A)

In distributed CDX environments, a trustworthy audit trail depends on a single, tamper-resistant record of events that spans all components. Centralized logs give you one source of truth for every action, making it possible to trace what happened, when, and by whom across the entire system. Immutability protects past records from alteration, so the history of actions remains credible even after incidents. Synchronized clocks ensure that time stamps line up across different services, which is essential for correctly ordering events and performing accurate incident analysis. Secure access to the logs prevents unauthorized viewing or tampering, preserving confidentiality and integrity. Tamper-evident storage adds a layer of protection by making any attempted changes detectable—often through cryptographic methods or append-only structures. Regular reviews keep governance active: they surface anomalies, verify compliance, and maintain ongoing trust in the audit process.

If logs were decentralized with unsynchronized clocks and no reviews, event ordering could become ambiguous, and there would be little accountability or visibility across the system. Local logs with no central access control miss the ability to audit actions across components. Logs kept only for debugging and not reviewed routinely fail to provide a durable, auditable trail needed for security and compliance.