iSACA Cybersecurity Fundamentals Certification Practice Exam

What does Security Event Management (SEM) aim to address?

1. The overproduction of data logs

2. Physical security of devices

3. System performance issues

4. Employee training on cybersecurity

The correct answer is: The overproduction of data logs

Security Event Management (SEM) primarily focuses on the aggregation, analysis, and management of security-related events generated by various systems and devices within an organization. The objective of SEM is to address the challenges posed by the high volume of data logs produced by security devices, applications, and systems, which can be overwhelming to manage without a structured approach. By concentrating on the overproduction of data logs, SEM solutions aim to identify and prioritize significant security incidents from the noise of extensive log data. This enables security teams to respond more effectively to actual threats by filtering out irrelevant information and focusing on alarms that warrant further investigation. In contrast, while physical security of devices, system performance issues, and employee training on cybersecurity are all important aspects of an organization's overall security posture, they do not fall under the main objectives of SEM. Physical security relates more to safeguarding hardware and facilities, system performance is typically managed by IT operations, and employee training focuses on raising awareness about security practices rather than managing security events directly.