Exam CISA topic 1 question 56 discussion

D. The SIEM is decentralized.

Answer: D

decentralization makes it inconsistent

Ad hoc review is not appropriate. SIEM without review or following up alert is useless.

D. The SIEM is decentralized. The greatest concern when reviewing an organization's security information and event management (SIEM) solution would be if the SIEM is decentralized (Option D). A decentralized SIEM could lead to fragmented data, incomplete visibility, and difficulties in effectively monitoring and responding to security incidents. A centralized SIEM allows for consistent monitoring, analysis, and response across the organization's entire infrastructure, enhancing security and reducing blind spots.

D. The SIEM is decentralized

D. The SIEM is decentralized. A decentralized SIEM can lead to gaps in monitoring and increased complexity in managing security events. This can result in a higher risk of security incidents going undetected or not being properly addressed. Therefore, a decentralized SIEM would be of greatest concern when reviewing an organization's security information and event management solution.

I would choose D. SIEM should be not be decentralized, at least what I have seen it in my 20 years of experience

An SIEM solution that lacks a standard, structured reporting process could lead to the missed detection of security events or the misinterpretation of events, which could have serious consequences for an organization's security posture. A structured reporting process, with clear definitions and criteria for security events, is critical for the effective use of a SIEM solution