Study. uk . com
  1. Home
  2. All questions
  3. Question 392

CISM study material · question 392 of 1000

Network monitoring data is reviewed in isolation by the operations team. Which improvement does NIST recommend?

  1. Restricting access to it to the network team only
  2. Retaining it for a longer period before analysis
  3. Reporting it directly to the regulator
  4. Correlating it with other sources such as incident statistics, corrective action plans and configuration management records
Show the answer

Answer: D. Correlating it with other sources such as incident statistics, corrective action plans and configuration management records

SP 800-100 wants monitoring data mined for trends and set against incident statistics, corrective action plans, configuration management records and whatever else is available, rather than read alone.

Source: NIST SP 800-100 (NIST) — Table 2-1 Network Monitoring

Challenge yourself on this topic → Study as cards