While investigating a suspected intrusion, an analyst finds that a server's security event log has no entries for a 40-minute window during which an administrator account was active elsewhere on the network, followed by an event recording that the audit log was cleared. Which indicator of compromise is MOST directly shown?

Log manipulation is an indicator of compromise in which an attacker deletes, alters, or interrupts logging to remove evidence of their actions. The combination in this scenario is characteristic: a gap that coincides with suspicious privileged activity and an explicit event showing the audit log was cleared, which typically requires administrative rights and is itself a high-value detection. Resource exhaustion leading to log rollover would overwrite the oldest entries according to the retention setting; it does not create a gap in the middle of a timeline or generate a clearing event. Impossible travel concerns authentications from locations too far apart for the elapsed time and says nothing about missing records on a server. A logic bomb is malicious code that executes when a condition such as a date is met; even if one existed, the evidence presented points to tampering with the logs rather than a time-triggered payload. Exam caveat: log manipulation is detected most reliably when logs are forwarded off the host in near real time, because a local copy can be wiped by anyone holding administrative rights on that host. Operational check: compare the server's local log against the SIEM copy for the same window, alert on audit-log-cleared events, and investigate the administrator account's sessions during the gap.