Study. uk . com
  1. Home
  2. All questions
  3. Question 431

CISSP study material · question 431 of 500

A server receives logs from several hundred hosts and forwards them onward. What does NIST SP 800-92 call such a server, and where may the data live?

  1. A generator, since it produces normalised records of its own.
  2. A console, with data held wherever the monitoring team directs.
  3. A collector or aggregator, with data held on the log server itself or on a separate database server.
  4. A caching server, with data always held on separate database servers.
Show the answer

Answer: C. A collector or aggregator, with data held on the log server itself or on a separate database server.

Servers receiving logs from many generators are called collectors or aggregators, and the data may sit on those servers or on separate database servers.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.1 Architecture

Challenge yourself on this topic → Study as cards