Exam SY0-601 topic 1 question 714 discussion

B. The syslog server It is good security practice for organizations to have Syslog server configured and logs from all systems forwarded and stored to it, just in cases like this mentioned in the question, where attacker could get access to the host and delete all logs from it trying to cover his tracks.

B. The syslog server

Syslog is a standard protocol used to send log messages across an IP network. By configuring the syslog server to receive log messages from various systems and applications within the company's infrastructure, the administrator ensures that copies of the log messages are stored centrally and independently from the systems generating them. Even if the privileged user deleted log files from individual servers, the logs may still exist on the syslog server. This provides investigators with an additional source of information for reviewing activities, including the unauthorized access and document theft.

A syslog server is a central repository for log messages generated by various devices and applications on a network. It is a valuable tool , it can provide a comprehensive record of network activity. The log retention policy - is just a policy cannot be configure from the administrator

Since the attacker deleted all logs the only answer i can think is log retention policy. correcrt me if am wrong