Which of the following MUST the administrator of a security information and event management (SIEM) system ensure?

Question

Options

• AAll sources are reporting in the exact same Extensible Markup Language (XML) format.
• BData sources do not contain information infringing upon privacy regulations.
• CAll sources are synchronized with a common time reference.
• DEach source uses the same Internet Protocol (IP) address for reporting.

• A
  8% (2)
• B
  17% (4)
• C
  71% (17)
• D
  4% (1)

Explanation

A security information and event management (SIEM) system is a tool that collects, analyzes, and correlates data from various sources, such as logs, alerts, and sensors, to provide a comprehensive view of the security posture and events of an organization. A SIEM administrator must ensure that all sources are synchronized with a common time reference, such as Network Time Protocol (NTP), to enable accurate and consistent event correlation and reporting. The sources do not need to report in the exact same Extensible Markup Language (XML) format, as the SIEM system can parse and normalize different formats. The sources do not need to use the same Internet Protocol (IP) address for reporting, as the SIEM system can identify and map different sources based on their IP addresses or other attributes. The sources may contain information that infringes upon privacy regulations, but this is not the responsibility of the SIEM administrator to ensure, but rather the data owners and custodians.

No community discussion yet for this question.