Which attribute records the before and after state of an asset during a critical action in an audit trail?

• A. User Identity
• B. Timestamp
• C. Before/After State
• D. Affected Assets

Answer: (C)

In an audit trail, the most informative record for a critical action is the change in the asset itself. You want to see how the asset looked before the action and how it looks after, so you can precisely identify what was modified, by whom, and when. The Before/After State attribute provides those two snapshots—the asset’s state prior to the action and its state after—so you can reconstruct the event and verify what happened. Without this, you’d know who performed the action and when, and which assets were involved, but you wouldn’t be able to determine the exact change that occurred. This dual-state view makes investigations accurate and traceable.