The correct answer is B, Security Incident and Event Monitoring (commonly referred to as SIEM – Security Information and Event Management). SIEM solutions collect event logs from multiple sources such as servers, firewalls, routers, switches, endpoints, security devices, and applications. They then normalize, correlate, analyze, and store these logs to identify suspicious activities and security incidents. A major function of SIEM technology is to generate alerts when predefined rules, behavioral anomalies, or threat indicators are detected.
In CEH v13 Security Operations and Incident Response topics, SIEM systems play a critical role in centralized log management, event correlation, threat detection, compliance reporting, and incident investigation. By correlating events across multiple systems, SIEM tools can identify attacks that may not be visible when examining individual logs separately. Examples include detecting brute-force attacks, privilege escalation attempts, malware infections, lateral movement, and data exfiltration activities.
The other options are incorrect because an Intrusion Prevention System focuses on blocking attacks, a Network Sniffer captures packets, and a Vulnerability Scanner identifies weaknesses rather than correlating security logs. Therefore, the best answer is Security Incident and Event Monitoring (SIEM).
