Which of the following is a logging best practice for incident detection?

• A. Centralized log collection
• B. Decentralized log storage with no central indexing
• C. Disable logs on weekends
• D. Logging disabled by policy

Answer: (C)

Centralized log collection is essential for effective incident detection because it creates a single, comprehensive view of activity across the entire environment. When logs from endpoints, servers, network devices, applications, and cloud services are funneled into centralized repositories, you can normalize and parse diverse data consistently, retain it according to policy, and feed it into analytics or a SIEM. This unified dataset makes it possible to search efficiently, apply correlation rules, and detect complex patterns that span multiple systems. It also speeds up investigations by providing a coherent timeline and reducing blind spots caused by siloed log storage.

Storing logs in disparate locations with no central index fragments visibility, so cross-system correlations become much harder and detections rely on individual system data. Logging can’t be trusted to exist if logging is turned off or made inconsistent; removing logs or policy-based logging outages creates obvious gaps that attackers can exploit and defenders cannot investigate later. In short, centralized collection provides the broad, timely visibility needed to detect incidents quickly and respond effectively.