Exam CISM topic 1 question 20 discussion

B. Security information and event management (SIEM) tool. Accodring to ChatGPT: The BEST single source of evidence to review when investigating an alleged breach of an organization's network is the Security Information and Event Management (SIEM) tool. The SIEM tool collects and aggregates log data from various sources throughout the network, such as firewalls, intrusion detection systems, and servers. The data is then analyzed and correlated to identify potential security incidents or breaches.

B is correct

A SIEM tool is designed to collect, analyze, and correlate logs and events from various sources within the network. It provides a comprehensive view of activities and potential security incidents, making it a valuable source of evidence during a breach investigation. SIEM tools can help identify patterns of behavior, anomalies, and potential indicators of compromise, allowing the security team to investigate and respond to security incidents effectively. While file integrity monitoring (FIM) software (option A), intrusion detection systems (IDS) (option C), and antivirus software (option D) are important components of a security infrastructure, a SIEM tool can centralize and analyze data from these and other sources, providing a more holistic view of the security landscape.

B. Security information and event management (SIEM) tool

C is interesting to review, but SIEM will have more info