mediumMultiple ChoiceObjective-mapped
SSCP SIEM Practice Question
An IT auditor reports that firewall logs are not being reviewed regularly. Which control should be implemented to address this finding?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Security Information and Event Management (SIEM) system
A SIEM system automates log collection, correlation, and alerting, ensuring that firewall logs are monitored and reviewed in a timely manner. Option A is incorrect; archiving logs to read-only medium preserves logs but does not enforce review. Option B is incorrect; disabling low-priority logging reduces data but does not address the lack of review. Option C is incorrect; increasing retention extends storage but still requires manual review, which is the root problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Archive logs to a read-only medium
Why it's wrong here
Archiving preserves logs but does not facilitate review.
- ✗
Disable logging for low-priority events
Why it's wrong here
Reducing log volume may cause security events to be missed.
- ✗
Increase the log retention period to 12 months
Why it's wrong here
Retention does not guarantee review.
- ✓
Deploy a Security Information and Event Management (SIEM) system
Why this is correct
SIEM automates log monitoring and alerting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.