CompTIA SecurityX (CAS-005) CAS-005 — Question 265

An auditor is reviewing the logs from a web application to determine the source of an incident. The web application architecture includes an internet-accessible application load balancer, a number of web servers in a private subnet, application servers, and one database server in a tiered configuration. The application load balancer cannot store the logs. The following are sample log snippets: Which of the following should the auditor recommend to ensure future incidents can be traced back to the sources?