Study. uk . com
  1. Home
  2. All questions
  3. Question 515

CompTIA Security+ study material · question 515 of 611

Why should logs be forwarded off the host promptly?

  1. To allow normalisation to occur
  2. To satisfy the retention schedule
  3. To reduce disk usage on the host
  4. So an attacker who takes control of the host cannot erase the record of how they arrived
Show the answer

Answer: D. So an attacker who takes control of the host cannot erase the record of how they arrived

Once the host is compromised its local logs are under the attacker's control; a forwarded copy is not.

Source: NIST SP 800-92 (NIST) — SP 800-92 § 3.1 Architecture

Challenge yourself on this topic → Study as cards