What should be reviewed to identify anomalies or suspicious activity?

What should be reviewed to identify anomalies or suspicious activity?

• A. All system components
• B. Logs of all servers and system components that perform security functions
• C. Logs and security events for all system components
• D. Only CHD/SAD logs

Answer: (C)

The essential idea is to gather and review evidence from every part of the environment that can affect security. Anomalies or suspicious activity are detected by looking at both what happened (the logs) and what was flagged as a potential issue (security events or alerts). When you review these sources for all system components, you get a complete picture: authentication attempts, access to sensitive data, configuration changes, and alerts from security tools all together. This enables you to spot patterns like repeated failed logins from one user, unusual access times, or unexpected data access, which might indicate a breach or insider activity. Choosing to look only at some components or only certain logs can miss important signals. Limiting to CHD/SAD logs, or focusing on only components that perform security functions, would leave gaps in visibility. Centralized collection and review of logs and security events across all system components is what truly supports detecting anomalies and responding promptly.

The essential idea is to gather and review evidence from every part of the environment that can affect security. Anomalies or suspicious activity are detected by looking at both what happened (the logs) and what was flagged as a potential issue (security events or alerts). When you review these sources for all system components, you get a complete picture: authentication attempts, access to sensitive data, configuration changes, and alerts from security tools all together. This enables you to spot patterns like repeated failed logins from one user, unusual access times, or unexpected data access, which might indicate a breach or insider activity.

Choosing to look only at some components or only certain logs can miss important signals. Limiting to CHD/SAD logs, or focusing on only components that perform security functions, would leave gaps in visibility. Centralized collection and review of logs and security events across all system components is what truly supports detecting anomalies and responding promptly.