A monitoring apparatus comprises a specifying part, a storing part, and a restoring part. The specifying part specifies an access source. The storing part stores changed item(s) in the environment caused by the activity of the access source. The restoring part restores an environment that is referred to when responding to an operation(s) of the access source based on the changed item(s) of the environment stored by the storing part.