CAS-005 · Question #516
A company SIEM collects information about the log sources. Given the following report information: Which of the following actions should a security engineer take to enhance the security monitoring…
The correct answer is A. Calibrate the timing on the log sources to enhance event correlation. The timestamps in the report are inconsistent in format and precision, which hinders accurate event correlation in the SIEM. Calibrating and synchronizing the timing on log sources (e.g., using NTP) ensures logs can be correlated reliably, enhancing the overall security…
Question
A company SIEM collects information about the log sources. Given the following report information:
Which of the following actions should a security engineer take to enhance the security monitoring posture?
Exhibits
Options
- ACalibrate the timing on the log sources to enhance event correlation.
- BImplement a centralized use case library to get alerts based on the type of log sources.
- CPerform a non-reporting device assessment to collect missing log sources.
- DCreate a resiliency plan to prevent losing event logs from log sources.
How the community answered
(46 responses)- A74% (34)
- B7% (3)
- C15% (7)
- D4% (2)
Explanation
The timestamps in the report are inconsistent in format and precision, which hinders accurate event correlation in the SIEM. Calibrating and synchronizing the timing on log sources (e.g., using NTP) ensures logs can be correlated reliably, enhancing the overall security monitoring posture.
Community Discussion
No community discussion yet for this question.