Question

A security analyst is establishing a recurring log review process for a financial application. Management wants the review to reliably surface privileged-account misuse without generating overwhelming volumes of raw event data for humans to read manually. Which approach BEST meets this requirement?

Accepted Answer

Configure the SIEM to correlate privileged-account events against defined baselines and alert only on deviations, then have analysts review the flagged anomalies

Answer

Export all privileged-account log entries daily to a spreadsheet for a manual line-by-line reviewer

Answer

Increase log retention to seven years so that all privileged activity is available for future forensic reconstruction

Answer

Disable verbose logging on privileged accounts to reduce the data volume that must be reviewed