Analysts investigating incidents must log in to each of forty servers separately to read local logs, and correlating events across systems takes hours. Which activity would MOST improve their ability to investigate across all servers?
Select an answer to reveal the explanation.
Short Explanation
Forty separate diaries are impossible to read side by side. Log aggregation drops them all into one place with the same timestamps and fields, so you can search once and see the whole story. Bigger local logs just make forty bigger diaries.
Full Explanation
Log aggregation collects events from many sources into a central platform, and a security information and event management (SIEM) system then normalizes fields, aligns timestamps, indexes the data for search, and applies correlation rules across sources. Analysts can follow an account or IP address through every server in one query, and alerts can trigger on patterns that span systems. Central collection also protects evidence, because an attacker who clears local logs on a compromised host cannot erase copies already forwarded. Increasing local log size improves retention on each host but leaves the core problem untouched: analysts still visit forty systems and correlate by hand, and local logs remain exposed to tampering. Nightly email of log files delays visibility by up to a day, creates unsearchable attachments, and moves sensitive data through mail systems. Port mirroring copies network packets, not host log events; it supports packet inspection tools rather than reading authentication or application logs. Exam caveat: aggregation requires consistent time synchronization so correlated events line up. Operational check: verify that all forty servers appear as active log sources, confirm their clocks are synchronized, and run a test query that returns one user's activity across several hosts.