Study. uk . com
  1. Home
  2. All questions
  3. Question 764

CISM study material · question 764 of 1000

Given the volume of potentially adverse events, what does NIST recommend organisations rely on?

  1. Technical solutions that filter large event datasets down to a subset suitable for human viewing and analysis
  2. Hiring enough analysts to review every one of the events that the whole estate generates in the course of each working day
  3. Reviewing only those events that come from the internet-facing systems in the estate and simply ignoring all of the rest
  4. Reducing the number of log sources collected
Show the answer

Answer: A. Technical solutions that filter large event datasets down to a subset suitable for human viewing and analysis

SP 800-61r3 accepts the event volume is generally far too high for people, and points to technical filtering that narrows the dataset to a subset a human can actually look at.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.AE.R1

Challenge yourself on this topic → Study as cards