Exam SY0-601 topic 1 question 177 discussion

Set up hashing will provide integrity

I say C. The way SIEM protects logs is by write protecting them. Quote from Darill Gibson's securit+ 501 book, "Logs/WORM: A SIEM typically includes methods to prevent anyone from modifying log entries. This is sometimes referred to as write once read many (WORM). As logs are received, the SIEM will aggregate and correlate the log entries. After processing the logs, it can archive the source logs with write protection."

The correct answer is C. Write protect the aggregated log files and move them to an isolated server with limited access. Here’s a breakdown of why option C is the best choice for ensuring the integrity of aggregated log files within a Security Information and Event Management (SIEM) system: Write Protection: This prevents any modifications to the log files after they are created. Once logs are written, protecting them from changes ensures that the data remains trustworthy and tamper-proof. Isolated Server with Limited Access: By storing the logs on an isolated server, you reduce the risk of unauthorized access and potential tampering. Limited access control ensures that only designated personnel can interact with the logs, further securing the integrity of the data.

HASHING = INTEGRITY. Anytime I see the keyword "integrity" in these questions, I glace at the answers and see hashing.

Hashing source log files does nothing to ensure the integrity of aggregated log files. Technically, all answers here are wrong. You should hash the aggregated log files AND move them to an isolated server.

Once the log files are aggregated, they cannot be tampered with, as write protection prevents any modifications. Moving them to an isolated server with limited access further enhances security by reducing the risk of unauthorized access.

Option A, “Set up hashing on the source log file servers that complies with local regulatory requirements,” is indeed a security measure, but it doesn’t directly ensure the integrity of the aggregated log files within a SIEM. Hashing is used to verify the integrity of data during transmission or storage, ensuring that the data hasn’t been tampered with. However, this measure is typically applied at the source log file servers, not on the aggregated log files within the SIEM. On the other hand, option C, “Write protect the aggregated log files and move them to an isolated server with limited access,” directly targets the aggregated log files in the SIEM, ensuring their integrity by preventing unauthorized access or modifications. So, while both options are security measures, option C is more directly related to the question’s focus on the integrity of aggregated log files within a SIEM.

Because you need to ensure integrity.

I personally agree with C because we must ENSURE integrity, not just check if files were tampered with.

The correct answer is C. Write protect the logs https://www.techtarget.com/searchsecurity/tip/Security-log-management-and-logging-best-practices

Hashing DOES NOT ensure integrity..it will only tell you if it is different/altered/changed. Answer is C.

A. Set up hashing on the source log file servers that complies with local regulatory requirements.

Cant be hashing because hashing isn't even secure without salting

It's C. From Darril Gibson's Sy0-601 book: "The following list outlines some additional capabilities shared by most SIEMS: - log collectors - data inputs - log aggregation - correlation engine - reports - packet capture - user behavior analysis - sentiment analysis - security monitoring - automated triggers - time synchronization - event deduplication - Logs/WORM: A Siem typically includes methods to prevent anyone from modifying log entries. This is sometimes referred to as write once read many (WORM). As logs are received, the SIEM aggregates and correlates the log entries. After processing the logs, it can archive the source logs with write protection."

C. Write protect the aggregated log files and move them to an isolated server with limited access. This option directly addresses the integrity of the aggregated log files within the SIEM. Write protection helps prevent any unauthorized changes or tampering with the log data, while isolating the files on a server with limited access enhances security and controls over who can access and modify them. Option A (setting up hashing on the source log file servers) is also a good practice for ensuring log file integrity at the source level, but it may not directly address the integrity of aggregated log files within the SIEM, which was the specific focus of the question. Therefore, for maintaining the integrity of aggregated log files in the context of a SIEM, option C would be the more suitable choice.

C ensures that the log files are protected from unauthorized modifications and are stored in an environment with restricted access, which helps maintain their integrity and prevents tampering.

This is clearly C, as explained by others.