After a suspected intrusion on a critical permits server, investigators find large gaps where security and authentication logs should exist. What malicious indicator does this most strongly suggest?

Attackers often cover tracks by deleting, truncating, or disabling security and authentication logs after controlling a host. Large gaps where critical permits-server logs should exist, following a suspected intrusion, most strongly indicate anti-forensics rather than a benign disk-full event limited to temp files. Municipal permitting systems need intact audit trails for both security investigation and public-record accountability.

Benign disk-full events that only affect temporary files would not selectively erase security and authentication history while leaving the investigative narrative empty in those channels. Successful application allow listing of approved binaries only is a preventive control outcome, not an explanation for missing logs after intrusion. Proper isolation of an infected CAD workstation on a quarantine VLAN is containment hygiene elsewhere; it does not create log gaps on the permits server.

Exam caveat: missing logs are an indicator of attacker activity or of logging failure—you must still investigate root cause—but exam items that pair intrusion suspicion with deliberate gaps expect “covering tracks.” Do not pick a positive control (allow listing, isolation) as the malicious indicator.

Operational check: immediately forward logs off-box to a SIEM or immutable store going forward, image the permits server, compare local gaps to any retained remote copies, rebuild if integrity is uncertain, and treat absent auth logs as a compliance and chain-of-custody problem for city attorneys as well as IT.