CyberCertPrepSecurity FundamentalsSecurity ToolsEASYFree question
What is the primary purpose of a SIEM system?
- A.To encrypt data at rest
- B.To manage employee passwords, since forensic imaging tools write to the source disk to record the acquisition
- C.To collect, correlate, and analyze security events from multiple sources for threat detection
- D.To block malware from entering the network; sandboxed detonation returns a verdict without executing the sample
Why C is correct
A SIEM (Security Information and Event Management) system aggregates log data from multiple sources (firewalls, servers, endpoints, applications), correlates events to identify patterns, and generates alerts for potential security incidents. It provides a centralized view of an organization's security posture and supports incident investigation.
Know someone studying for Security Fundamentals? Send them this one.