CSSLP: Certified Secure Software Lifecycle Professional

Question

You are the Security Manager for Tech Perfect Inc. You have configured a SIEM server for the following purposes:

Analyze data from different log sources
Correlate events among log entries
Identify and prioritize significant events
Initiate responses to events when required

One of the log-monitoring staff members wants to know which SIEM product features will help accomplish these purposes. Which features would you recommend? Each correct answer represents a complete solution.

Choose all that apply.

Choose four

Explanation

SIEM analyst-support capabilities include a GUI for reviewing and analyzing related event data, a security knowledge base for interpreting vulnerabilities and log messages, incident tracking and reporting workflows, and asset storage/correlation to prioritize events affecting important or vulnerable assets. Transmission confidentiality protects logs in transit, but it is not part of this specific set of log-monitoring features.

Learn more

NIST SP 800-92: Guide to Computer Security Log Management

CSSLP: Certified Secure Software Lifecycle Professional

AstroTutor

Notes

Readiness

QuestionQ15

Community Discussion