Your audit logs are stored in a platform administered by the same team that has production access. What is the problem?

What the interviewer is testing

Whether you notice the control that most commonly fails in insider risk scenarios.

The problem

The people whose actions are being logged can modify the log. That defeats the control entirely, because the audit trail's value depends on being tamper-evident by parties with an interest in it.

This is not an accusation about the team. It is a structural property that an auditor will identify immediately, and it undermines every control that relies on audit evidence — segregation of duties, access review, and incident forensics.

The fix

Write audit logs to a store the operators cannot modify or delete:

• A separate account or subscription with different administrators and a different access path
• Append-only or immutable retention enforced by the storage platform, with a retention lock that the account's own administrators cannot shorten
• Write-only access from the source: the emitting system can append and cannot read or delete
• Alerting on any change to the logging configuration, routed outside the team

For higher assurance, hash-chaining or periodic anchoring of log digests makes tampering detectable even by someone with full storage access.

The related gaps to check while you are there

Retention. Operational log retention of 30 days cannot evidence a control across a 12-month audit period, and this is discovered at audit after the records are gone. Audit evidence needs its own retention decision, usually in a separate cheaper store.

Attribution through shared identity. Actions performed by a service account everyone uses provide no evidence of who did what, which collapses several controls at once.

Coverage. Does the log capture data access at the record level for sensitive datasets, or only authentication events? Bulk reads are the signal that matters for insider risk, and they are usually not logged.

What a strong answer adds

Framing it constructively for the team: this protects them as much as it constrains them. An engineer whose actions are provably recorded in a store they cannot alter is protected from suspicion, and the control removes them from the set of people who could plausibly have tampered.

Common weak answers

Restricting log deletion by policy, which the administrators can change. Assuming the cloud provider's own audit log covers application-level access.