Question

A Security Operations Center (SOC) manager notices a significant increase in unclassified events

on the incident handler's Security Event and Incident Management (SIEM) dashboard. At the same
time, someone or something raises the number of incidents. The manager investigates these
incidents further to ensure efficient and timely incident response. Which combination of data
sources would provide the MOST comprehensive view to support the manager's investigation?
A. Firewall logs, network traffic captured by sensors, and log files generated by operating system
(OS) components of server host computers
B. OS-specific security logs, log files generated by applications and services running on hosts, and
automated reports from the SIEM tool
C. Endpoint logs, automated reports from the SIEM tool, and metadata from end-user system
activities and summarized report incidences
D. Application and end-user system activities in log files from network-based vulnerability
scanners, application logs, and endpoint logs

Answer 1

Combination A, including firewall logs, network traffic captured by sensors, and log files generated by the operating system (OS) components of server host computers, would provide the most comprehensive view to support the manager's investigation.

Step-by-step explanation:

The MOST comprehensive view to support the manager's investigation would be provided by combination A, which includes firewall logs, network traffic captured by sensors, and log files generated by the operating system (OS) components of server host computers.

Firewall logs can provide information about incoming and outgoing network connections, while network traffic captured by sensors can detect and analyze network activity. Log files generated by the OS components of server host computers can provide information about system-level events and user activities.

By combining these three data sources, the SOC manager can have a comprehensive view of network activity, system events, and user activities, which will help in investigating the increase in unclassified events and incidents.

Learn more about Combination of data sources for investigating security incidents