SIEM is described as a combination of which two components?

• A. SIM and SEM
• B. IDS and IPS
• C. Log collection and alerting
• D. Endpoint protection and firewall

Answer: (A)

The question tests what SIEM is built from: two areas called security information management and security event management. Security information management focuses on gathering, normalizing, storing, and reporting on security data from across the environment, so you have a clear, searchable view of what happened over time. Security event management handles the real-time side—monitoring events as they occur, correlating disparate alerts to spot patterns that indicate a potential incident, and producing alerts for responders. Put together, SIEM provides both the data foundation and the live detection capability.

This is why the combination of SIM and SEM is the best description. Other options describe related security concepts—like IDS/IPS as detection systems, or general log collection and alerting, or separate controls like endpoints and firewalls—but they do not capture the two-part composition that defines SIEM.