350-201 Question 126
Select 4Your company recently implemented a Cisco Secure Network Analytics solution to monitor and detect threats in real-time. As part of the deployment, the team needs to ensure proper security data management to collect, analyze, and store logs from various sources. Which of the following best practices should the team follow for effective security data management?
- A
Ensure normalization of data from different sources for consistent analysis
- B
Store all security logs indefinitely to maintain a complete historical record
- C
Implement role-based access controls (RBAC) to restrict access to sensitive security data
- D
Regularly review and optimize the data retention policy based on compliance requirements
- E
Enable real-time correlation of events to detect potential threats proactively
Show answer and explanation
Correct answers: A, C, D, E
Explanation
Effective security data management involves normalizing diverse data, implementing RBAC for secure access, reviewing data retention policies to balance compliance and storage needs, and enabling real-time event correlation to proactively detect threats. Storing all logs indefinitely is not a best practice due to potential inefficiencies and high costs.
- A. Correct.
Normalization of data ensures that logs from diverse sources follow a consistent format, enabling effective analysis and correlation.
- B. Incorrect.
Storing all logs indefinitely can lead to excessive storage costs and inefficiencies. Data retention should align with organizational needs and compliance requirements.
- C. Correct.
Role-based access controls (RBAC) ensure that only authorized personnel can access sensitive security data, reducing the risk of insider threats.
- D. Correct.
Regularly reviewing and optimizing the data retention policy ensures that logs are retained for the appropriate duration to meet compliance requirements without overwhelming storage.
- E. Correct.
Real-time correlation of events is crucial for identifying and responding to threats quickly, thereby enhancing security posture.