ITPEC FE Subject A October 2024 Question 33

Analysing logs collected from many devices and supporting the administrator — SIEM centralizes and correlates security events.

SIEM gathers logs from firewalls, IDS/IPS, servers, proxies and other devices into one place, normalizes them and correlates events across sources to detect signs of an attack that no single log would reveal. It then alerts administrators and supports their investigation and response.

Answer (c)

Why not others:

• •(a) — centrally controlling network devices and changing their configuration and security settings is the job of a network management system or SDN controller; SIEM analyses, it does not configure
• •(b) — running a file in an isolated virtual environment and watching its behavior, such as traffic to a C&C server, is a sandbox
• •(d) — inspecting packet headers, identifying the receiving application and controlling the traffic describes an application-aware (next-generation) firewall

Key rule: SIEM = collect, correlate and analyse logs from many sources to detect incidents and support response; firewalls, sandboxes and management consoles act on traffic, files or device settings instead.

Security · AI-written, may contain errors