312-39 · Question #43
You are working as a SOC analyst in a multinational company with multiple data centers and remote offices. Security logs are stored locally at each site, making it difficult to correlate incidents…
The correct answer is A. Centralized logging. Centralized logging is the foundation for enterprise-wide visibility and correlation. When logs remain local at each site, SOC analysts lose the ability to quickly pivot across systems, detect multi-stage attacks, and correlate signals (for example, an identity compromise at…
Question
You are working as a SOC analyst in a multinational company with multiple data centers and remote offices. Security logs are stored locally at each site, making it difficult to correlate incidents across different locations. Recently, an advanced persistent threat (APT) compromised multiple servers, but due to multiple sources of logs and inconsistent monitoring, the attack was detected only after significant data exfiltration. To improve visibility, streamline log analysis, and enable faster incident response, you need to implement a solution that aggregates logs from all sources into a unified system. Which solution will you implement?
Options
- ACentralized logging
- BEvent tracing
- CDistributed logging
- DLocal logging
How the community answered
(38 responses)- A92% (35)
- C3% (1)
- D5% (2)
Explanation
Centralized logging is the foundation for enterprise-wide visibility and correlation. When logs remain local at each site, SOC analysts lose the ability to quickly pivot across systems, detect multi-stage attacks, and correlate signals (for example, an identity compromise at one location leading to lateral standardizes ingestion, parsing, retention, and search, enabling consistent detections and faster triage. It also improves incident response by providing a single source of truth for timelines and scoping. Distributed logging and local logging keep data fragmented; even if collection exists, the lack of central correlation slows investigations and increases blind spots-exactly what the scenario describes. “Event tracing” is typically an internal diagnostic/telemetry method (often application or OS-level tracing) and is not the overarching architectural solution for aggregating logs across multiple sites. For SOC operations, centralized logging also supports governance and compliance by enforcing retention, access controls, and audit trails, and it enables consistent alerting and reporting across the entire environment.
Topics
Community Discussion
No community discussion yet for this question.