A city government's IT director was notified by the city council that the following cybersecurity requirements must be met to be awarded a large federal grant:
- Logs for all critical devices must be retained for 365 days to enable monitoring and threat hunting.
- All privileged user access must be tightly controlled and tracked to
mitigate compromised accounts.
- Ransomware threats and zero-day vulnerabilities must be quickly
identified.
Which of the following technologies would BEST satisfy these requirements? (Choose three.)
Correct Answer: B,D,F
Log aggregator: A log aggregator is a tool that collects, parses, and stores logs from various sources, such as devices, applications, servers, etc. A log aggregator can help meet the requirement of retaining logs for 365 days by providing a centralized and scalable storage solution.
PAM: PAM stands for privileged access management. It is a technology that controls and monitors the access of privileged users (such as administrators) to critical systems and data.
PAM can help meet the requirement of controlling and tracking privileged user access by enforcing policies such as least privilege, multifactor authentication, password rotation, session recording, etc.
SIEM: SIEM stands for security information and event management. It is a technology that analyzes and correlates logs from various sources to detect and respond to security incidents.
SIEM can help meet the requirement of identifying ransomware threats and zero-day vulnerabilities by providing real-time alerts, threat intelligence feeds, incident response workflows, etc.