Company policy dictates that events from at least the past three months must be stored centrally for review. When a security incident occurs the security analyst investigates the underlying cause…

The correct answer is A. Log reduction and analysis. The scenario describes a failure at the centralized log location, likely due to storage exhaustion or log flooding that caused the system to stop capturing events properly. Log reduction and analysis addresses this directly: by filtering, aggregating, and normalizing logs…

Enterprise Security Operations

Question

Company policy dictates that events from at least the past three months must be stored centrally for review. When a security incident occurs the security analyst investigates the underlying cause and sees the following:

The error appears to have started five days ago at the centralized location. Which of the following would prevent this issue from reoccurring?

Options

ALog reduction and analysis
BHost-based IDS
CSCAP scanner
DFile integrity monitoring

How the community answered

(39 responses)

A
74% (29)
B
8% (3)
C
5% (2)
D
13% (5)

Explanation

The scenario describes a failure at the centralized log location, likely due to storage exhaustion or log flooding that caused the system to stop capturing events properly. Log reduction and analysis addresses this directly: by filtering, aggregating, and normalizing logs before storage, unnecessary noise is eliminated, storage requirements are managed, and critical events are retained within the mandated three-month window. A host-based IDS (B) detects intrusions but does not solve log management. A SCAP scanner (C) checks configuration compliance. FIM (D) monitors file changes. None of the other options address the root cause of centralized log storage failures.

Topics

#log management#centralized logging#log retention#SIEM

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice