Which tool is most directly associated in the course material with collecting and correlating logs for continuous security monitoring?

### Why this is right Security information and event management (SIEM) systems collect and correlate log data from different sources so analysts can identify patterns and suspicious activity. The material associates them with continuous monitoring and detection. ### The concept Logs record activity from endpoints, applications, servers, and networks. A SIEM brings data together and applies rules or analytics to support detection and investigation. It does not automatically prove that an incident occurred; analysts still assess alerts and context. Other tools address different problems, such as preventing data loss or controlling privileged accounts. ### The other options - **B. Data loss prevention (DLP)**: Monitors or restricts sensitive data movement rather than serving primarily as a log-correlation platform. - **C. Privileged access management (PAM)**: Controls and monitors privileged accounts. - **D. A backup restoration utility**: Helps restore data and systems during recovery. ### Terms - **SIEM**: Security information and event management. - **Log correlation**: Linking records from multiple sources to identify a meaningful sequence or pattern. ### Remember SIEM organizes security logs for detection; it is not a substitute for human analysis or response.