QuestionQ90

Network Monitoring and Analysis

NexaCorp, an enterprise with a robust Linux infrastructure, has experienced repeated downtime with no apparent cause. The company’s initial investigation indicates possible unauthorized system-level changes. NexaCorp’s IT team recognizes that it must monitor and analyze system logs more efficiently to identify the cause. What is the optimal approach for NexaCorp to monitor and analyze its Linux system logs to detect and prevent unauthorized changes?

  • A Monitor and analyze the /var/log/syslog file daily for any unusual activities.
  • B Implement a SIEM system that centralizes, correlates, and analyzes logs in real-time.
  • C Set up an automated script to send alerts if the ‘last’ command shows unexpected users.
  • D Only focus on monitoring SSH logs since most changes likely come through remote access.
Explanation

A SIEM centralizes logs from multiple systems, correlates related events, and analyzes them in real time, providing broad visibility needed to identify unauthorized changes and respond before they cause further disruption. CISA recommends centralized logging and SIEM capabilities for log aggregation, correlation, querying, visualization, and alerting.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!