Which of the following should be the GREATEST concern for an IS auditor reviewing the implementation of a security information and event management (SIEM) system?

A. SIEM rule tuning is only reviewed annually.

B. Network monitoring events are not aggregated into the SIEM.

C. Only the last seven days of logs from the SIEM are maintained for review.

D. Security operations center (SOC) staff have not been fully trained on how to use the SIEM.








 

Suggested Answer: B

Community Answer: B



This question is in CISA Certified Information Systems Auditor Exam
For getting Certified Information Systems Auditor (CISA) Certificate










Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by ISACA. 
Trademarks, certification & product names are used for reference only and belong to ISACA.
The website does not contain actual questions and answers from ISACA's Certification Exams.