What is the definition of log correlation?

Which of the following definitions best describes the concept of log correlation?

  1. Combining relevant logs from multiple sources into one location
  2. Searching and processing data to identify patterns of malicious activity Source Reference Answer
  3. Making a record of the events that occur in the system
  4. Analyzing the log files of the system components

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests the distinction between log aggregation and correlation, where the trap is selecting the definition for collecting logs (Option A) instead of analyzing them (Option B).

Log correlation involves analyzing data from various sources to identify patterns or malicious activity. The community agrees that while log aggregation collects data, correlation is the analytical process used to detect threats.

Selecting Option A is a frequent error because it describes log aggregation, which is often confused with correlation but refers only to the collection of logs into one location.

Community Discussion (4 comments)

festuuss 👍 2 Selected: A
Combining Logs from Different Sources: In large environments, logs come from multiple systems such as servers, applications, firewalls, network devices, and security systems. Log correlation involves integrating and analyzing these logs togeth
gingergroot 👍 2 Selected: B
Best answer is B. It's not A because combining relevant logs from multiple sources is log aggregation, not correlation.
Fhaddad81 👍 1
The best definition for log correlation is: (ChatGPT) .Answer is A A. Combining relevant logs from multiple sources into one location. Log correlation involves aggregating logs from various sources, such as servers, network devices, and applications, to establish relationships between events and provide a comprehensive view of system activity. This process helps identify patterns, detect anomalies, and facilitate troubleshooting or security analysis.
Fourgehan 👍 3 Selected: B
Log correlation involves analyzing log data from multiple sources to identify patterns, trends, or events that may indicate malicious activity or security incidents. By correlating logs from different devices or systems (e.g., firewalls, servers, intrusion detection systems), security analysts can detect complex threats that might be missed when looking at logs in isolation. This helps to identify attacks that involve multiple steps or components, such as a coordinated intrusion attempt, or to detect abnormal behavior patterns that are indicative of a security breach

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Option B is correct because log correlation is fundamentally about the analysis of aggregated data to discover relationships, sequences, or patterns that indicate a security incident. It transforms raw data into actionable intelligence by linking events across different systems.

Why the Other Options Are Wrong

Option A describes log aggregation, which is the process of gathering logs into a central repository but does not imply the analysis of those logs. Option C refers to the basic generation of log records (logging), and Option D is a generic description of log analysis that lacks the specific context of cross-referencing multiple sources to find patterns.

Community Comment Notes

Community members emphasized the difference between aggregation and correlation, noting that combining logs (A) is a separate step from identifying patterns (B). Users pointed out that correlation specifically involves searching and processing data to spot malicious activity, making B the precise definition.

Official Reference

https://csrc.nist.gov/pubs/sp/800/92/final

Exam Strategy

Remember that 'aggregation' means collecting logs, while 'correlation' means connecting the dots. If the question asks about identifying patterns or malicious intent, choose correlation over aggregation.

Related Analysis

A company is required to use certified hardware when buildin

A-Grade

After a series of account compromises and credential misuse,

S-Grade

Which of the following addresses individual rights such as t

A-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide