350-201 Question 127
Select 3A security operations team is tasked with managing a large volume of security event logs generated by devices such as firewalls, routers, and endpoint protection systems. The team needs to ensure the data is stored securely, can be analyzed efficiently, and is accessible for forensic investigations when needed. Which set of practices should the team prioritize to achieve effective security data management?
- A
Implement centralized log collection using a Security Information and Event Management (SIEM) system.
- B
Use data encryption to secure log storage and transmission.
- C
Discard older log data every 30 days to save storage space.
- D
Tag and classify log data based on its source and sensitivity.
- E
Analyze log data only during active security incidents.
Show answer and explanation
Correct answers: A, B, D
Explanation
Effective security data management involves centralized collection, securing data through encryption, and organizing it for efficient analysis. Practices like using a SIEM system, encrypting log data, and tagging logs are essential for maintaining visibility, security, and accessibility of logs. Discarding logs prematurely or analyzing them only during incidents undermines the goals of proactive and comprehensive security.
- A. Correct.
Implementing centralized log collection using a SIEM system is a critical practice for managing security data effectively. It enables efficient analysis, correlation, and monitoring across various sources.
- B. Correct.
Using data encryption ensures that logs are protected from unauthorized access during storage and transmission, which is essential for maintaining data integrity and confidentiality.
- C. Incorrect.
Discarding older log data every 30 days is not a recommended practice in security data management. Logs should be retained based on compliance, regulatory, and investigative requirements.
- D. Correct.
Tagging and classifying log data helps in organizing and prioritizing it based on its source, sensitivity, and relevance, leading to more efficient analysis and response.
- E. Incorrect.
Analyzing log data only during active security incidents is a reactive approach and does not align with proactive security practices. Continuous monitoring and analysis are key to identifying potential threats early.