Study. uk . com
  1. Home
  2. All questions
  3. Question 439

CISSP study material · question 439 of 500

A team must correlate logs from sources that record time in different formats and label the field differently. Which function addresses this, and what is its cost?

  1. Filtering, which suppresses entries whose format cannot be parsed, but discards data.
  2. Aggregation, which merges the differing entries, but loses the original timestamps.
  3. Rotation, which restarts the files in a common format, but breaks historical continuity.
  4. Normalisation, which converts every field to one representation and category, but is resource-intensive on complex entries.
Show the answer

Answer: D. Normalisation, which converts every field to one representation and category, but is resource-intensive on complex entries.

Normalisation converts each field to a particular data representation and categorises it consistently, most commonly for dates and times, but can be very resource-intensive for complex entries.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.2 Functions

Challenge yourself on this topic → Study as cards