Study. uk . com
  1. Home
  2. All questions
  3. Question 436

CISSP study material · question 436 of 500

A logging team suppresses duplicate and routine informational entries from its analysis pipeline. What does NIST SP 800-92 say about the effect on the original logs?

  1. Filtering is only permitted where the original files have already been archived.
  2. Filtering does not affect generation or short-term storage, because it does not alter the original files.
  3. Filtering rewrites the original files with the suppressed entries marked.
  4. Filtering removes the entries at the source, so the original files shrink.
Show the answer

Answer: B. Filtering does not affect generation or short-term storage, because it does not alter the original files.

Filtering suppresses entries from analysis, reporting or long-term storage, and normally leaves generation and short-term storage untouched because the original files are not altered.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.2 Functions

Challenge yourself on this topic → Study as cards