A continuous information security monitoring program can BEST reduce risk through which of the following?

Question

Options

• ACollecting security events and correlating them to identify anomalies
• BFacilitating system-wide visibility into the activities of critical user accounts
• CEncompassing people, process, and technology
• DLogging both scheduled and unscheduled system changes

• A
  28% (10)
• B
  50% (18)
• C
  14% (5)
• D
  8% (3)

Explanation

Facilitating system-wide visibility into the activities of critical user accounts (B) is the best answer because continuous monitoring programs are designed to reduce risk by ensuring that the most dangerous actors in an environment - privileged and critical users - are observable in real time. When organizations can see what these accounts are doing across all systems, they can detect abuse, compromise, or insider threats before significant damage occurs, directly reducing risk at the highest-impact vector.

Why the distractors fall short:

• A (collecting and correlating events) describes a SIEM function - a useful tool within monitoring, but not the primary mechanism by which monitoring reduces risk.
• C (people, process, technology) is a design principle that describes what a good program encompasses, not how it reduces risk - it's a characteristic, not an outcome.
• D (logging scheduled and unscheduled changes) is change management logging - valuable, but too narrow in scope to represent the best risk reduction of an entire monitoring program.

Memory tip: Think of it as "watch the keys, not just the locks" - critical user accounts hold the most powerful keys in any environment, so monitoring their activity system-wide gives you the highest-value risk reduction. The word "BEST" in the question signals you need the highest-impact, most direct answer, which is visibility over privileged behavior.

No community discussion yet for this question.