A finance user denies having changed a payment record in a cloud ERP application. The audit log shows the change under a shared service account that five people use, and log entries are kept as ordinary editable text. Which change would most improve the organization's ability to prove who made such a change in the future?
Select an answer to reveal the explanation.
Short Explanation
Non-repudiation needs two things: a name that belongs to exactly one person, and a record nobody can quietly edit. A shared account breaks the first, and editable text breaks the second. Don't fall for the IP-address answer; it adds detail but still can't tell you which of the five people did it.
Full Explanation
Non-repudiation means a party cannot credibly deny an action because the evidence binds the action to that party and the evidence itself cannot be altered undetected. Two conditions follow. Every action must be performed under a unique, strongly authenticated identity, ideally with MFA, so the log can attribute it to one individual. The log entries must be integrity-protected, using digital signatures or hash chaining where each record includes the hash of the previous one, so tampering breaks the chain. Rotating the shared password weekly leaves five people with equal claim to every action; a list of who knew the password supports suspicion, not proof. Nightly copies of an editable file provide availability, but if the original can be changed before the copy runs, the backup simply preserves altered content, and the copy is no harder to edit. Recording source IP address and geolocation adds context, yet several users can share a network location or VPN egress, and the attribute still points to the shared identity rather than a person. Exam caveat: hashing alone shows integrity; a signature tied to an identity is what supports non-repudiation. Operational check: confirm no human uses shared credentials in the ERP and that the log integrity verification job reports an unbroken chain.