SY0-701 Question 138
Single answerMonitoringA security analyst is tuning the organization's monitoring strategy after a recent incident in which malware spread from a user workstation to a file server. The investigation found that logs existed on individual systems, but the team did not notice the attack until users reported missing files. Management wants earlier detection of similar activity without requiring analysts to manually review logs on each host. Which solution would BEST improve the organization's ability to detect and respond to this type of event in a timely manner?
- A
Configure a SIEM to collect and correlate logs from endpoints, servers, and network devices, and generate alerts for suspicious patterns such as unusual file access and lateral movement
- B
Increase the file server's local log retention period from 7 days to 90 days so investigators can review more historical data after an incident
- C
Deploy full-disk encryption on all user workstations to prevent malware from accessing files over the network
- D
Disable failed logon auditing on endpoints to reduce the number of events analysts need to review during investigations
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement a SIEM because the core issue is ineffective monitoring, not lack of data. Security monitoring is most effective when logs from endpoints, servers, network devices, and security tools are centralized, normalized, and correlated so analysts can detect suspicious patterns quickly. This aligns with widely accepted best practices from sources such as NIST SP 800-61 for incident handling and NIST SP 800-137 for information security continuous monitoring, both of which emphasize centralized collection, analysis, and ongoing monitoring of security-relevant events. In practice, SIEM platforms help reduce time to detect by automating alerting and correlation across systems, which is exactly what the organization needs after missing malware activity until users noticed the damage.
- A. Correct.
Correct. A SIEM improves monitoring by centralizing logs from multiple sources and correlating events to identify suspicious activity that may not be obvious when reviewing individual systems separately. In this scenario, the key problem is delayed detection because relevant evidence was distributed across hosts and not actively monitored. A SIEM can generate near-real-time alerts for indicators such as multiple failed logons, authentication attempts across systems, unusual SMB/file-access behavior, privilege escalation, or signs of lateral movement. This directly addresses the requirement for earlier detection and faster response.
- B. Incorrect.
Incorrect. Extending local log retention can help with forensic investigations after an incident, but it does not significantly improve timely detection. The scenario specifically states the organization wants earlier identification of attacks without manual review of logs on each host. More retained data is useful for post-incident analysis, not for centralized, proactive monitoring and alerting.
- C. Incorrect.
Incorrect. Full-disk encryption protects data at rest on a device, such as if a laptop is lost or stolen. It does not provide monitoring, alerting, or correlation for malware spreading over the network. Malware running on an authenticated workstation can still access network shares based on the user's permissions. This option addresses a different security objective than the one described.
- D. Incorrect.
Incorrect. Disabling failed logon auditing would reduce visibility and make detection worse, not better. Failed logon events are often valuable monitoring data for identifying password attacks, unauthorized access attempts, and lateral movement. Someone might choose this option because reducing noise can be part of tuning monitoring, but removing important security telemetry is not an appropriate solution.