Which function records and analyzes what a person or program actually did?

• A. Authentication
• B. Authorizations
• C. Auditing
• D. All of the above

Answer: (C)

Auditing is about recording and analyzing what a person or program did. It creates an audit trail that captures who performed an action, what was done, when it happened, and where it originated, enabling accountability, incident response, and compliance. Logs from operating systems, applications, and databases feed into this process and can be examined by log-management or SIEM tools to detect anomalies or reconstruct events. Authentication verifies identity and authorization defines what actions are allowed, but they are not primarily concerned with tracking every action taken; auditing is the mechanism that records and analyzes those activities.