Which statement best describes SIEM?

• A. A network appliance that blocks unauthorized traffic
• B. A software solution that aggregates and analyzes activity from different resources across an organization's entire IT infrastructure
• C. A tool that routes traffic between networks
• D. A database for storing user credentials

Answer: (B)

SIEM focuses on central collection and analysis of security data from across the IT environment. The statement that best describes it is that it is a software solution that aggregates and analyzes activity from different resources across an organization's entire IT infrastructure. It gathers logs and events from devices, servers, applications, and security controls, normalizes them into a common format, correlates events to detect patterns that might indicate threats, and provides alerts, dashboards, and reports to support detection, incident response, and compliance. It’s not a device that blocks traffic like a firewall, nor a router that directs traffic, nor a database used to store user credentials. Those functions belong to firewall/IPS, routing devices, and credential repositories, respectively.