Study. uk . com
  1. Home
  2. All questions
  3. Question 517

CompTIA Security+ study material · question 517 of 611

What does a security information and event management system add beyond centralised log storage?

  1. Aggregation and correlation so analysts see a pattern rather than isolated entries
  2. Automatic patching of the logging hosts
  3. Guaranteed retention compliance
  4. Encryption of logs at rest
Show the answer

Answer: A. Aggregation and correlation so analysts see a pattern rather than isolated entries

Storage alone leaves the analyst reading thousands of entries; correlation is what surfaces the chain of activity.

Source: NIST SP 800-92 (NIST) — SP 800-92 § 3.4 Security Information and Event Management Software

Challenge yourself on this topic → Study as cards