CompTIA Project+ (PK0-005)Basics of IT and GovernanceHard
A project manager is implementing a new regulatory compliance framework for data handling. The framework requires centralized collection, analysis, and real-time monitoring of security alerts and logs from all IT systems. Which security tool is specifically designed to fulfill these requirements?
- AVulnerability Scanner
- BSecurity Information and Event Management (SIEM) system
- CData Loss Prevention (DLP) system
- DIntrusion Detection System (IDS)
Show answer & explanationAnswer & explanation
Correct answer: B. Security Information and Event Management (SIEM) system
A Security Information and Event Management (SIEM) system is specifically designed for centralized collection, aggregation, analysis, and real-time monitoring of security logs and events from various sources across an IT infrastructure, which is crucial for compliance and security operations.
Why the other options are wrong
- A. A vulnerability scanner identifies weaknesses in systems but does not collect, analyze, or monitor logs in real-time.
- C. A DLP system focuses on preventing sensitive data from leaving the organization, not on centralized log management and analysis.
- D. An IDS primarily detects suspicious activity but doesn't centralize logs from all systems for broad analysis and reporting.
Security Information and Event Management (SIEM)
A security solution that combines security information management (SIM) and security event management (SEM) functions into one system. It provides real-time analysis of security alerts generated by network hardware and applications.
- Centralizes logs and events from across the IT estate.
- Performs real-time analysis and correlation.
- Supports security incident detection, response, and compliance reporting.
Memory trick: SIEM: Security Info, Events, Monitoring.