Exam SY0-601 topic 1 question 498 discussion

A. Security information and event management

Security information and event management (SIEM) is the technology that will accomplish the objective of centralizing logs to create a baseline and gain visibility on security events. SIEM is a comprehensive approach to security management that involves the collection, aggregation, analysis, and correlation of log data from various sources throughout an organization's IT infrastructure. It allows security teams to monitor, detect, and respond to security incidents effectively. A SIEM system can collect log data from various sources, such as firewalls, network devices, servers, applications, and endpoints, and then normalize and correlate this data to provide a centralized view of security events and activities. It can help identify suspicious or anomalous behavior, detect security incidents, and provide real-time alerts for potential threats.

Security Information and Event Management (SIEM) is about log files. I choose A

A SIEM's functionality includes centralised logging and the ability to baseline a system then detect events that are anomalous to that baseline. The question didn't state anything about traffic or networks so it can't be a firewall and a vulnerability scanner has nothing to do with logs.