ISC2 CC Security Operations Practice Question
An organization is building a log management capability so its security team can detect and investigate incidents across many systems. Which TWO practices BEST support effective centralized log collection and analysis? (Choose two.)
⚠ Common exam trap
The trap here is focusing on storage cost or convenience and overlooking that clock synchronization and tamper-resistant central storage are what make logs usable as evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Forward logs to a central repository with integrity protection and controlled access
Effective centralized logging depends on trustworthy, correlated data. Synchronized clocks make cross-source timelines reliable, while forwarding logs to a protected central repository preserves evidence even if a source host is compromised. Together these practices enable detection and investigation. Local-only storage, disabled logging, and ungoverned configuration changes all create blind spots or permit tampering, defeating the purpose of centralization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Forward logs to a central repository with integrity protection and controlled access
Why this is correct
Centralizing logs with integrity protection and restricted access preserves evidence and enables cross-system correlation. If a source host is compromised, its forwarded records remain intact elsewhere. Access controls prevent tampering or unauthorized viewing. This combination directly supports detection and investigation, making it a core practice for effective centralized log collection and analysis across a diverse environment.
- ✗
Disable logging on high-traffic servers to reduce storage costs
Why it's wrong here
Disabling logging on busy servers removes exactly the data most needed for detecting and investigating incidents, and those systems are often prime targets. Storage costs should be managed through retention tiers, filtering, and aggregation rather than by eliminating visibility. This practice creates blind spots that undermine the entire log management effort and is not a recommended approach.
- ✗
Store all logs only on the local systems that generate them
Why it's wrong here
Keeping logs solely on originating hosts prevents correlation across systems and leaves evidence vulnerable, since an attacker who compromises a host can alter or delete its logs. Centralized collection is specifically intended to overcome these limitations. Local-only retention undermines both detection and investigation, so this practice contradicts the goal of building a centralized log management capability.
- ✓
Synchronize clocks across all systems using a consistent time source such as NTP
Why this is correct
Accurate, synchronized timestamps are essential for correlating events from multiple sources into a coherent timeline. Without consistent time, investigators cannot reliably determine the sequence of actions during an incident. Using a common time source like NTP ensures log entries from servers, network devices, and endpoints align, making centralized analysis and forensic reconstruction dependable across the environment.
- ✗
Allow every administrator to modify log settings without change control
Why it's wrong here
Uncontrolled changes to logging configuration allow an attacker or careless insider to disable or redirect logging, destroying evidence and hiding activity. Log configuration should itself be governed and audited. Permitting unrestricted modification undermines the integrity of collected records and contradicts the principles of reliable centralized log management, so it is not a supportive practice here.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Log management
Log management is the process of collecting, storing, analyzing, and disposing of log data generated by computer systems, networks, and applications to ensure security, compliance, and operational health.
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.