Study. uk . com
  1. Home
  2. All questions
  3. Question 437

CISSP study material · question 437 of 500

A thousand log entries each recording part of one network scan are replaced by a single entry stating how many hosts were probed. Which log management function is this?

  1. Log normalisation.
  2. Log reduction.
  3. Event aggregation.
  4. Event filtering.
Show the answer

Answer: C. Event aggregation.

In event aggregation similar entries are consolidated into a single entry containing a count of occurrences, exactly as with entries recording parts of one scan.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.2 Functions

Challenge yourself on this topic → Study as cards