Question
An organization has centralized logging capability at the on-premises data center and wants a solution that can consolidate logging from deployed cloud workloads. The organization would like to automate the detection and alerting mechanism. Which of the following best meets the requirements?
- A. IDS/IPS
- B. SIEM Correct
- C. Data lake
- D. Syslog
Explanation
A SIEM collects and correlates logs from on-premises and cloud sources in one place and applies rules to detect events and raise alerts automatically. Syslog only transports and stores log messages, a data lake stores data without built-in detection, and an IDS/IPS inspects network traffic rather than consolidating logs.
