How does a SIEM support security operations during an incident?

• A. Deletes all logs after 24 hours.
• B. Correlates events across sources to generate alerts and aid investigation.
• C. Executes malware payloads automatically.
• D. Prevents any data from leaving the network.

Answer: (B)

A SIEM’s role during an incident is to collect and normalize logs from across the environment and use correlation rules to connect events that span multiple sources. This capability creates a coherent picture of what happened, when it happened, and how different systems interacted, enabling security teams to see patterns that wouldn’t be obvious from a single log. By linking disparate alerts into a single incident and providing a centralized timeline, the SIEM accelerates detection, investigation, and response, which is exactly what is needed during an incident.

Deleting logs after 24 hours would hinder investigation and compliance. Automatically executing malware payloads would be dangerous and inappropriate for defense. Preventing any data from leaving the network is a preventive control, not a detection/analysis function, and a SIEM does not by itself stop exfiltration.