Exam SY0-601 topic 1 question 248 discussion

SIEM works best only if have "A. Logs from each device type and security layer to provide correlation of events ". Firewall logs are not enough during IR process

I think it's A because SIEM needs massive amounts of information to be efficient. B is wrong because it says ONLY firewall logs, which would not give you enough information to respond to the totality of a circumstance.

Feed that SIEM with logs babyyy

Do I want to only read Moskba Pravda for accurate reporting of the news, or so I want to read multiple sources so I can eliminate blind-spots created by subjective reporting?

A. Logs from each device type and security layer to provide correlation of events. A SIEM is most effective when it can correlate data from multiple sources across different layers of the infrastructure. This includes logs from firewalls, intrusion detection and prevention systems, network devices, servers, endpoints, and any other critical components of the IT environment. The ability to cross-reference and analyze this diverse data helps identify patterns that could indicate a security incident, thus providing a comprehensive view of the security posture and aiding in investigations.

It seems people only know how to talk. The answer is B . Keywords "network"

To adequately support an investigation, the SIEM (Security Information and Event Management) solution should be fed with logs from each device type and security layer within the network. This is because different devices and security layers generate logs that contain valuable information about events and activities within the network. By collecting and analyzing logs from various sources, the SIEM can correlate events and detect patterns or anomalies that may indicate potential security incidents or breaches.

The information that should feed into a SIEM solution to adequately support an investigation is logs from each device type and security layer to provide correlation of events. A SIEM (Security Information and Event Management) solution aggregates log data from various sources within a network, including firewalls, intrusion detection systems, servers, and endpoints, to provide a holistic view of security events. By aggregating and correlating logs from various devices and security layers, a SIEM solution can identify and alert on security threats and help security analysts investigate and respond to incidents. Therefore, the best answer is A. Logs from each device type and security layer to provide correlation of events.

"A" should be the right exam answer. In the real world, you might have to be a bit more picky which logs to choose, as you´d have limitations like EPS based licenses for your SIEM or limited hardware resources, so it´s not always the best solution to feed everything to your SIEM.

B may be the answer because we are talking about a new network. Network is associated with firewall based rules.