A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response. Which of the following should the team…

The correct answer is C. Implement a central logging server, allowing only log ingestion. A central logging server ensures logs are collected in a tamper-proof manner and only ingested (not modified). This prevents attackers from altering logs locally. Key concepts: Logs should be centrally stored to prevent tampering. Enabling log forwarding to a secure SIEM…

Submitted by ashley.k· Mar 6, 2026Security Operations

Question

A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response. Which of the following should the team do to best accomplish this goal?

Options

AIntegrate a file-monitoring tool with the SIEM.
BChange the log solution and integrate it with the existing SIEM.
CImplement a central logging server, allowing only log ingestion.
DRotate and back up logs every 24 hours, encrypting the backups.

How the community answered

(19 responses)

B
5% (1)
C
84% (16)
D
11% (2)

Explanation

A central logging server ensures logs are collected in a tamper-proof manner and only ingested (not modified). This prevents attackers from altering logs locally. Key concepts: Logs should be centrally stored to prevent tampering. Enabling log forwarding to a secure SIEM improves integrity.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice