An organization is struggling to differentiate threats from normal traffic and access to systems. A security engineer has been asked to recommend a system that will aggregate data and provide metrics that will assist in identifying malicious actors or other anomalous activity throughout the environment. Which of the following solutions should the engineer recommend?a. Web application firewall b. SIEM c. IPS d. UTM e. File integrity monitor

b. SIEM.

Explanation:

In this scenario, an organization is struggling to differentiate threats from normal traffic and access to systems. A security engineer has been asked to recommend a system that will aggregate data and provide metrics that will assist in identifying malicious actors or other anomalous activity throughout the environment. The solution the engineer should recommend is the Security information and event management (SIEM).

Security information and event management is an enterprise software that provides a holistic view and analyzes activity from various resources across an entire information technology (IT) infrastructure.

The SIEM is used to aggregate important data from multiple source such as servers, routers, firewall, switches, domain controllers, antivirus software and analyzes the data to detect any threat, deviation from the norm, as well as investigate in order to take appropriate actions. Some examples of the SIEM system are IBM QRadar, Splunk, LogRhythm etc.

no. when the asker posts the question they can make a question worth what ever they think is a fair price. although it must be within the limit of the points they currently own. 5 is the minimum number of points a question can be worth. if a question is complicated or has lots of parts to it, it is better to make it worth more because more people will be more willing to answer.

hope this !