A regulated bank must keep firewall events inside its own data centers for many years, well past what the FMC database holds, and it wants Cisco's own analytics rather than another third-party platform. Which Security Analytics and Logging option meets those requirements?
Select an answer to reveal the explanation.
Short Explanation
Spot on — residency is the requirement that settles this one. Security Analytics and Logging (On Premises) keeps event data inside your own data centers, with capacity sized for the required retention, while giving analysts long-term search beyond the FMC. The cloud tier is capable, but it isn't where your rules allow the data to sit.
Full Explanation
Deploying Security Analytics and Logging on premises is the fit because it provides Cisco analytics while keeping event data in the bank’s data centers; sizing the deployment for the required retention addresses the period beyond the FMC database’s capacity. The SaaS approach still provides Cisco analytics and can support extended retention, but its cloud storage violates the bank’s requirement that events remain in its own data centers. Exporting events to an on-premises SIEM supports local, multi-year archiving, but shifts analysis to another platform rather than using Cisco’s analytics. Relying on the FMC database keeps data on premises and uses Cisco’s tools, but its standard retention window does not meet the requirement for many years beyond what the database holds. Exam caveat: distinguish the location of the retained event data from the location of the management interface; an on-premises FMC alone does not establish that a separate analytics service stores data on premises. Practical check: confirm the proposed on-premises deployment’s supported capacity, retention settings, and storage sizing against expected event volume and the bank’s retention period.