Build an audit trail that shows when it was edited

short · 40 min · Objective 5.2

Task

Write an access log in which every entry carries the hash of the one before it, and a checker that finds the first entry that no longer matches -- the same idea that lets an auditor trust a log they did not write.

Steps

  1. Save lab/audit/trail.csv with header n,when,who,action,target,prev_hash,hash. For entry 1, prev_hash is 64 zeros; for every other entry it is the previous entry's hash.
  2. Each hash is the SHA-256, in hex, of n, when, who, action, target and prev_hash joined with |.
  3. Record these five entries: 2025-11-03T09:00:00 analyst.a read orders.csv; 2025-11-03T09:05:00 analyst.a export by-region.csv; 2025-11-04T14:30:00 steward.b update customers.csv; 2025-11-05T08:10:00 admin.c grant analyst.d; 2025-11-06T17:45:00 admin.c revoke analyst.d.
  4. Write lab/audit/verify.py to recompute every hash and print chain intact: N entries and last hash: with the first 16 characters of the final hash, or chain broken at entry N for the first entry that does not match.

Verify

These checks run in a POSIX shell with Python 3: Terminal on macOS or Linux, and on Windows Git Bash (it comes with Git for Windows) or WSL. On Windows, python3 is often a Microsoft Store placeholder that prints “Python was not found”; run alias python3=py in Git Bash first.

python3 lab/audit/verify.py lab/audit/trail.csv

chain intact: 5 entries, and last hash: b2c6129f262786b6. Change any field of any entry -- a time, a name, grant to read -- and the checker reports the chain broken at that entry, because every later hash depends on it. Anyone can still rebuild the whole chain after an edit, so the last hash has to be kept somewhere the editor cannot reach.

This is an independent study companion for CompTIA Data+ DA0-002 and is not produced by or endorsed by CompTIA.