The municipal SOC needs one place that collects firewall, Active Directory, and endpoint logs and correlates them into security events. Which tool best matches that purpose?
Select an answer to reveal the explanation.
Short Explanation
A SIEM is the city's security switchboard—it pulls firewall, directory, and endpoint logs into one place and correlates the story. A lobby guestbook or yearly spreadsheet cannot do that job.
Full Explanation
A SIEM aggregates and correlates security event data across heterogeneous sources—firewall, Active Directory, endpoint agents, and more—into a single municipal SOC workspace. Correlation rules and detections turn disparate logs into actionable security events, investigations, and tickets. That central collection and analysis role is exactly what CompTIA describes for SIEM in security operations monitoring.
A standalone label printer without network connectivity cannot collect or correlate enterprise logs. A physical visitor sign-in book is a facility process artifact, not a security-event analytics platform. An offline spreadsheet updated once per fiscal year lacks real-time ingestion, correlation, retention suitable for investigations, and automated alerting.
Exam caveat: SIEM value depends on log quality, time sync, use-case content, and tuning—buying a SIEM without feeding critical municipal sources or writing detections yields little. Distinguish SIEM (aggregate/correlate/alert) from single-host antivirus consoles or raw syslog piles.
Operational check: onboard firewall, identity, and endpoint feeds with NTP-aligned timestamps; enable detections for auth failures and privilege changes; retain per policy; and verify analysts can pivot from an alert to related events across city sources.