A network security administrator needs to set up a solution to: - Gather all data from log files in a single location. - Correlate the data to generate alerts. Which of the following should the…

The correct answer is D. SIEM. A SIEM (Security Information and Event Management) system does exactly two things described: it aggregates/collects log data from multiple sources into a single location, and it correlates that data using rules and analytics to generate alerts. Syslog (A) is a protocol for…

Cloud Network Security

Question

A network security administrator needs to set up a solution to:

Gather all data from log files in a single location.
Correlate the data to generate alerts.

Which of the following should the administrator implement?

Options

ASyslog
BEvent log monitoring
CLog management
DSIEM

How the community answered

(36 responses)

A
11% (4)
B
25% (9)
C
6% (2)
D
58% (21)

Explanation

A SIEM (Security Information and Event Management) system does exactly two things described: it aggregates/collects log data from multiple sources into a single location, and it correlates that data using rules and analytics to generate alerts. Syslog (A) is a protocol for forwarding log messages - it collects but does not correlate or alert. Event log monitoring (B) passively monitors logs but lacks automated correlation across sources. Log management (C) covers collection and storage but typically lacks the correlation and alerting engine that defines a SIEM.

Topics

#SIEM#Log Management#Security Monitoring#Alerting

Community Discussion

No community discussion yet for this question.

Full CNX-001 Practice