Study. uk . com
  1. Home
  2. All questions
  3. Question 445

CISSP study material · question 445 of 500

A large enterprise runs dozens of separate log management infrastructures and an auditor calls for consolidation into one. Which three objections does NIST SP 800-92 support? Choose three.

  1. A single infrastructure means one failure affects logging throughout the organisation.
  2. A single infrastructure would not scale to the volume the organisation produces.
  3. Logging occurs on logically or physically separate networks.
  4. Regulations forbid combining application and security logs in one store.
Show the answer

Answer: B. A single infrastructure would not scale to the volume the organisation produces.
C. Logging occurs on logically or physically separate networks.
A. A single infrastructure means one failure affects logging throughout the organisation.

SP 800-92 gives scalability limits, logging on separate networks, robustness concerns where one failure affects all logging, and interoperability issues as reasons a single infrastructure is often not feasible.

Source: NIST SP 800-92 (NIST) — SP 800-92 > 3.1 Architecture

Challenge yourself on this topic → Study as cards