Exam CISM topic 1 question 476 discussion

Logs would have gone to a SIEM.

Poor question. Now all firewalls come with log reporting and notifications. Install extra log monitoring would not help at all but waste of money. If a breach came thru, that must be from the untrained user(s)/insider(s) who brought in the malicious/Trojan/remote control software over the download files. Check cyber kill chain.

the best here is D...

D. log monitoring Log monitoring involves analyzing the logs generated by the firewall and other network devices to identify suspicious or malicious activity. It allows you to proactively detect and respond to security incidents, including breaches, by reviewing logs for signs of unauthorized access or unusual behavior. While web surfing controls, packet filtering, and application awareness are important security measures, they may not necessarily detect breaches as effectively

D. log monitoring

If you're not inspecting packets how would it knows what traffic is coming through? Amswer should be B.

For detection C is also an option. Integrating application awareness into security solutions provides them with valuable context that can improve network security as well as network routing.

It should be D - Log Monitoring since the wording "could have been detected earlier". Its about detection methods.

I guess D

maybe C. ambiguous question.