CompTIA CASP+ Practice Test

Which approach should be taken for log information security during architecture planning?

1. Store logs on local devices only

2. Encrypt all log files immediately

3. Implement an automated log management system

4. Archive logs after a set period

The correct answer is: Implement an automated log management system

Implementing an automated log management system is a proactive measure that enhances log information security during architecture planning. This approach enables organizations to effectively collect, analyze, and manage log data from various sources systematically. An automated system ensures timely aggregation of logs, which is critical for identifying security incidents and performing forensic analysis. Automated log management allows for better retention policies, compliance with regulatory requirements, and the capability to respond quickly to potential threats. It can also reduce the risks associated with human error in log management, enhancing the overall security posture of the organization. By automating the process, you can establish alerts for unusual activity, ensuring that security teams can act promptly when necessary. In contrast, relying solely on local devices for log storage may increase the risk of data loss in the event of a device failure or compromise. Encrypting all log files immediately, while a good practice, does not by itself guarantee comprehensive log management or analysis capabilities. Archiving logs after a set period might ensure retention but does not help with real-time monitoring or threat detection.