Which action would an attacker take to ensure logs cannot be used for prosecution by removing traces?

Which action would an attacker take to ensure logs cannot be used for prosecution by removing traces?

• A. Clearing Logs
• B. Disabling Auditing
• C. Auditpol
• D. Wevtutil

Answer: (A)

Removing traces from logs is about erasing evidence of activity. Clearing logs directly deletes the event records, which is exactly what an attacker would want to do to prevent prosecution by showing what happened. Disabling auditing would stop future logging but leaves already existing records intact, so it doesn’t remove past traces. Auditpol is a command to change what gets logged, not to erase logs. Wevtutil is a tool to manage event logs and could clear them, but the action described refers to the act of clearing logs itself, which is the direct method to remove traces.

Removing traces from logs is about erasing evidence of activity. Clearing logs directly deletes the event records, which is exactly what an attacker would want to do to prevent prosecution by showing what happened.

Disabling auditing would stop future logging but leaves already existing records intact, so it doesn’t remove past traces. Auditpol is a command to change what gets logged, not to erase logs. Wevtutil is a tool to manage event logs and could clear them, but the action described refers to the act of clearing logs itself, which is the direct method to remove traces.