Which activity leads to better network visibility?

Question

Options

• Aadding time stamps to log events
• Benabling all IPS signatures
• Cadding user context to events
• Dforwarding all events to a syslog server

• B
  5% (1)
• C
  91% (20)
• D
  5% (1)

Explanation

Adding user context to events (C) directly improves network visibility because it links raw network activity to specific identities - knowing who did what transforms ambiguous IP traffic into actionable intelligence for investigation and threat hunting.

• A is wrong because timestamps improve log correlation and forensics, but don't add visibility into what or who is involved - they're about when, not what.
• B is wrong because enabling all IPS signatures increases noise and false positives, which actually reduces effective visibility by burying real threats in alerts.
• D is wrong because forwarding events to a syslog server centralizes log storage and aids retention, but doesn't enrich or expand what you can see - it's a transport mechanism, not a visibility enhancement.

Memory tip: Think "visibility = context." You can't see clearly without knowing who is behind an event - user context is the lens that makes raw network data meaningful.

No community discussion yet for this question.