Exam CRISC topic 1 question 1795 discussion

D - If someone with high-level access can get to the raw log files without proper oversight, they can easily destroy the evidence or modify it, making the logs untrustworthy.

If privileged access management controls are weak, it increases the risk that individuals with elevated permissions could alter, delete, or tamper with logs without detection. This poses a direct threat to the integrity of the logs, as unauthorized changes could go unnoticed.

Logs may contain information that is sensitive or needed for forensic purposes, so they should be configured in ways that prevent alteration or deletion as well as preventing access by authorized personnel. In particular, they should be implemented in ways that prevent administrators with responsibility for systems or applications from altering or deleting logs made against their own scopes of responsibility. The risk practitioner should consider log access pennissions as part of evaluating the level of potential insider threat.

Strong privileged access control can ensure data integrity by limiting who has access to data.

It's not correct. D. Acces privileged controls the confidenciality, not the integrity. A SIEM (tracking changing logs) protect the integrity of the application.