NISTNIST CSFDetect FunctionEASYFree question
What types of data sources are typically monitored for security events?
- A.Firewall logs, and occasionally endpoint alerts, cover most attack scenarios
- B.Database access logs, and periodic manual reviews of administrator activity, cover most compliance-driven monitoring programs
- C.Email communications, and occasional manual spot checks of outbound attachments, catch most of the exfiltration attempts organizations actually see
- D.Network traffic, system logs, application logs, endpoint activity, user behavior, and authentication logs
Why D is correct
Comprehensive detection monitors multiple data sources including network flows, system/application logs, endpoint telemetry, identity systems, and cloud service logs.
Know someone studying for NIST CSF? Send them this one.