Exam CRISC topic 1 question 649 discussion

Collecting logs from different systems will have benefit of keeping a record of incidents. However, ANALYZING the logs will help identify the security variolations so the answer is C.

A. Developing threats are detected earlier. Analyzing logs collected from different systems allows for the correlation of events and behaviors that might not be apparent when looking at logs from a single system in isolation. This integrated view can often lead to the earlier detection of developing threats, providing an opportunity to mitigate risks before they become critical incidents. While options B, C, and D are valid benefits of log analysis, the greatest benefit in a proactive sense is the early detection of developing threats (Option A), as it enables timely response to minimize potential damage.

C. Security violations can be identified. Analyzing logs collected from different systems is primarily aimed at identifying security violations and anomalies in the behavior of these systems. It helps in detecting unauthorized access, unusual patterns of activity, and potential security breaches. While logs also support forensic investigations and maintaining a record of incidents, the primary benefit is the real-time or near-real-time identification of security violations, which can enable organizations to respond quickly to mitigate potential threats and minimize damage.

A is proactive, C is reactive. I think A is better

Agree with C.

should be C

A developing threat may or may not be detected sooner, but what is certain is that a breach can be detected.

Answer D the earlier detection of threats has the potential to prevent incidents from occurring in the first place, which is a greater benefit.

I thing answer should be A , since question mention from different systems which means pointing to correlation of events, agree that one good use is identifying violations but better use of identifying new or developing threats.

agree with C

should be C

Analysis of log data can identify security violations and be instrumental in forensics investigations.