CRISC Question 422

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  A. Developing threats are detected earlier. Analyzing logs collected from different systems allows for the correlation of events and behaviors that might not be apparent when looking at logs from a single system in isolation. This integrated view can often lead to the earlier detection of developing threats, providing an opportunity to mitigate risks before they become critical incidents. While options B, C, and D are valid benefits of log analysis, the greatest benefit in a proactive sense is the early detection of developing threats (Option A), as it enables timely response to minimize potential damage.

• Chose C1

  C. Security violations can be identified. Analyzing logs collected from different systems is primarily aimed at identifying security violations and anomalies in the behavior of these systems. It helps in detecting unauthorized access, unusual patterns of activity, and potential security breaches. While logs also support forensic investigations and maintaining a record of incidents, the primary benefit is the real-time or near-real-time identification of security violations, which can enable organizations to respond quickly to mitigate potential threats and minimize damage.

• 2

  A is proactive, C is reactive. I think A is better