What is the definition of log correlation?

SY0-701 By islever Editorial Last updated

Short answer

B Searching and processing data to identify patterns of malicious activity

Question

Which of the following definitions best describes the concept of log correlation?
  1. Combining relevant logs from multiple sources into one location
  2. Searching and processing data to identify patterns of malicious activity Correct Answer
  3. Making a record of the events that occur in the system
  4. Analyzing the log files of the system components

Key Takeaways

This question tests the distinction between log aggregation and correlation, where the trap is selecting the definition for collecting logs (Option A) instead of analyzing them (Option B).

Log correlation involves analyzing data from various sources to identify patterns or malicious activity. The community agrees that while log aggregation collects data, correlation is the analytical process used to detect threats.

Common mistake: Selecting Option A is a frequent error because it describes log aggregation, which is often confused with correlation but refers only to the collection of logs into one location.

Expert Analysis

Why the Answer Is Correct

Option B is correct because log correlation is fundamentally about the analysis of aggregated data to discover relationships, sequences, or patterns that indicate a security incident. It transforms raw data into actionable intelligence by linking events across different systems.

Why the Other Options Are Wrong

Option A describes log aggregation, which is the process of gathering logs into a central repository but does not imply the analysis of those logs. Option C refers to the basic generation of log records (logging), and Option D is a generic description of log analysis that lacks the specific context of cross-referencing multiple sources to find patterns.

Community Comment Notes

Community members emphasized the difference between aggregation and correlation, noting that combining logs (A) is a separate step from identifying patterns (B). Users pointed out that correlation specifically involves searching and processing data to spot malicious activity, making B the precise definition.

Official Reference

https://csrc.nist.gov/pubs/sp/800/92/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember that 'aggregation' means collecting logs, while 'correlation' means connecting the dots. If the question asks about identifying patterns or malicious intent, choose correlation over aggregation.

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Fourgehan 👍 3 Answered B
    Log correlation involves analyzing log data from multiple sources to identify patterns, trends, or events that may indicate malicious activity or security incidents. By correlating logs from different devices or systems (e.g., firewalls, servers, intrusion detection systems), security analysts can detect complex threats that might be missed when looking at logs in isolation. This helps to identify attacks that involve multiple steps or components, such as a coordinated intrusion attempt, or to detect abnormal behavior patterns that are indicative of a security breach
  2. festuuss 👍 2 Answered A
    Combining Logs from Different Sources: In large environments, logs come from multiple systems such as servers, applications, firewalls, network devices, and security systems. Log correlation involves integrating and analyzing these logs togeth
  3. gingergroot 👍 2 Answered B
    Best answer is B. It's not A because combining relevant logs from multiple sources is log aggregation, not correlation.
  4. Fhaddad81 👍 1
    The best definition for log correlation is: (ChatGPT) .Answer is A A. Combining relevant logs from multiple sources into one location. Log correlation involves aggregating logs from various sources, such as servers, network devices, and applications, to establish relationships between events and provide a comprehensive view of system activity. This process helps identify patterns, detect anomalies, and facilitate troubleshooting or security analysis.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide