CAS-002 · Question #91
When planning a complex system architecture, it is important to build in mechanisms to secure log information, facilitate audit log reduction, and event correlation. Besides synchronizing system…
The correct answer is D. A SIEM server with distributed sensors. For remote locations, a SIEM server with distributed sensors is the standard design pattern that enables local log collection and correlation while centralizing management and alerting.
Question
When planning a complex system architecture, it is important to build in mechanisms to secure log information, facilitate audit log reduction, and event correlation. Besides synchronizing system time across all devices through NTP, which of the following is also a common design consideration for remote locations?
Options
- ATwo factor authentication for all incident responders
- BA central SYSLOG server for collecting all logs
- CA distributed SIEM with centralized sensors
- DA SIEM server with distributed sensors
How the community answered
(50 responses)- A16% (8)
- B4% (2)
- C10% (5)
- D70% (35)
Why each option
For remote locations, a SIEM server with distributed sensors is the standard design pattern that enables local log collection and correlation while centralizing management and alerting.
Two-factor authentication for incident responders addresses access control, not log collection architecture or audit log reduction at remote sites.
A central SYSLOG server collects logs but lacks the correlation, normalization, and event reduction capabilities of a SIEM, making it insufficient for the described requirements.
A 'distributed SIEM with centralized sensors' inverts the architecture - centralizing sensors defeats the purpose of handling remote locations and creates the bandwidth and availability problems this design is meant to solve.
A SIEM with distributed sensors places collection and parsing agents at remote sites, reducing bandwidth consumption and ensuring logs are captured even during WAN outages, while the central SIEM server performs correlation, alerting, and long-term storage. This architecture is the accepted design for geographically dispersed environments where a fully centralized model is impractical.
Concept tested: SIEM architecture design for distributed remote locations
Source: https://csrc.nist.gov/publications/detail/sp/800-92/final
Topics
Community Discussion
No community discussion yet for this question.