Study. uk . com
  1. Home
  2. All questions
  3. Question 769

CISM study material · question 769 of 1000

Which practice does NIST identify as what makes event correlation practical across many sources?

  1. Sampling the logs from a representative subset of the systems in the estate at each review
  2. Continuously shipping logs from many sources into a small number of log servers
  3. Retaining all of the logs on the individual systems that had actually generated them in the first place
  4. Compressing logs before analysis
Show the answer

Answer: B. Continuously shipping logs from many sources into a small number of log servers

SP 800-61r3 pairs constant transfer of log data into a handful of servers with event correlation technology, which is what lets data captured by many sources be related.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 DE.AE-03.R1

Challenge yourself on this topic → Study as cards