CAS-001 · Question #63
When planning a complex system architecture, it is important to build in mechanisms to secure log information, facilitate audit log reduction, and event correlation. Besides synchronizing system…
The correct answer is D. A SIEM server with distributed sensors. A SIEM server with distributed sensors is the standard architecture for remote locations, centralizing correlation logic while placing lightweight collection agents at each site.
Question
When planning a complex system architecture, it is important to build in mechanisms to secure log information, facilitate audit log reduction, and event correlation. Besides synchronizing system time across all devices through NTP, which of the following is also a common design consideration for remote locations?
Options
- ATwo factor authentication for all incident responders
- BA central SYSLOG server for collecting all logs
- CA distributed SIEM with centralized sensors
- DA SIEM server with distributed sensors
How the community answered
(30 responses)- A7% (2)
- B7% (2)
- C17% (5)
- D70% (21)
Why each option
A SIEM server with distributed sensors is the standard architecture for remote locations, centralizing correlation logic while placing lightweight collection agents at each site.
Two-factor authentication for incident responders is an access control measure, not a log collection or event correlation design consideration for remote sites.
A central SYSLOG server aggregates raw logs but lacks the correlation engine, alerting, and dashboarding capabilities required for effective event correlation and audit reduction.
A distributed SIEM with centralized sensors inverts the correct architecture - analysis engines are expensive to distribute, while sensors are lightweight and should be deployed at remote sites.
Placing distributed sensors at remote locations allows log collection close to the source while forwarding data to a centralized SIEM for correlation, alert generation, and audit log reduction. This architecture minimizes bandwidth consumption at remote sites and consolidates analytical intelligence in one place, which is the accepted design pattern for geographically dispersed enterprises. NTP synchronization complements this by ensuring log timestamps are consistent across all sensors feeding the central SIEM.
Concept tested: SIEM architecture design with distributed sensors for remote locations
Source: https://csrc.nist.gov/publications/detail/sp/800-137/final
Topics
Community Discussion
No community discussion yet for this question.