156-215.81.20 · Question #111
In SmartEvent, a correlation unit (CU) is used to do what?
The correct answer is D. Analyze log entries and identify events. See the full explanation below for the reasoning.
Question
In SmartEvent, a correlation unit (CU) is used to do what?
Options
- AReceive firewall and other software blade logs in a region and forward them to the primary log
- BCollect security gateway logs, index the logs and then compress the logs.
- CSend SAM block rules to the firewalls during a DOS attack.
- DAnalyze log entries and identify events.
How the community answered
(42 responses)- A14% (6)
- B7% (3)
- C5% (2)
- D74% (31)
Community Discussion
7
Mateus R.Jun 25, 2026The correct answer is D. Think of a correlation unit like a detective at a crime scene, not the person collecting evidence, but the one analyzing all the clues already gathered and saying "these three separate log entries together mean an attack just happened." That is exactly what a SmartEvent CU does, it processes log entries against defined correlation policies to recognize patterns and identify security events worth raising an alert about.
Bao N.Jun 27, 2026Good analogy but worth adding that the CU only fires when a match threshold is crossed within the defined time window, so two out of three clues showing up just under the wire still means no alert.
Wesley A.Jun 27, 2026First time through I picked B because the word "analyze" made me think of indexing and processing logs, and SmartEvent does sit on top of the log infrastructure so it felt right. What snapped me out of it was remembering that indexing and compressing is the Log Server job, not SmartEvent's job. The Correlation Unit specifically takes those already-collected logs and runs them against your event policy rules to spot patterns and fire off events, so D is the clean answer. A and C are traps too, A is describing log forwarding which is a SmartDomain or Log Server function, and C is SAM rules which live in SmartView Monitor territory, not SmartEvent at all.
Prof. SaraJun 29, 2026Solid breakdown, and the exam loves to test that SAM rules (choice C) represent real-time reactive blocking pushed down to the gateway, which is the conceptual opposite of SmartEvent Correlation Unit work that runs retrospectively against collected log data, so keeping those two mechanisms in separate mental buckets is worth drilling before test day.
Prof. SaraJun 27, 2026I nearly picked B because "collect and index" sounds like what any log-processing component would do, but the name itself is the giveaway: a Correlation Unit correlates, meaning it analyzes log entries and identifies events, which is exactly what D says, while indexing and compression belong to the Log Server role, not the CU.
Mateus R.Jun 27, 2026Right, the way I lock it in is to think of the Log Server as the filing clerk who boxes and shelves everything, and the Correlation Unit as the detective who pulls those boxes and says "these three separate log entries are actually one incident."
Bao N.Jun 27, 2026D is locked in, though I would have appreciated a little more precision there since a CU does not just "identify" events, it actually correlates multiple log entries against rule logic to surface a named event, which is a meaningful distinction from what a log server does on its own. Option A describes something closer to a log forwarder or secondary log server role, and that one trips people up when they confuse the SmartEvent topology with the SmartLog architecture.