Computer Hacking Forensic Investigator (CHFI v10) — Question 33

Which of the following statements is TRUE about SQL Server error logs?

Answer options

• A. SQL Server error logs record all the events occurred on the SQL Server and its databases
• B. Forensic investigator uses SQL Server Profiler to view error log files
• C. Error logs contain IP address of SQL Server client connections
• D. Trace files record, user-defined events, and specific system events

Correct answer: D

Explanation

The correct answer is D because trace files are specifically designed to log user-defined and certain system events in SQL Server. Option A is incorrect as error logs do not capture every single event but focus on errors and critical information. Option B is misleading since SQL Server Profiler is used for monitoring and tracing activity, not specifically for viewing error log files. Option C is false because error logs do not typically contain IP addresses of client connections.