Which term describes aggregating logs from all devices into a single repository to enable cross-environment correlation and forensic evidence?

• A. Incident Response
• B. Forensic Imaging
• C. Centralized Logging
• D. Data Loss Prevention

Answer: (C)

Centralized logging is the practice of collecting logs from all devices and systems into a single repository so you can analyze events across different environments and pull together evidence for forensic investigations. This creates a unified timeline, makes searching and correlating events easier, and supports thorough incident analysis by providing access to logs from diverse sources in one place. It’s the foundational step before more advanced security analytics or incident response work, and it often feeds into SIEM tools that help detect patterns spanning multiple systems.

This isn’t about the incident response process itself, which focuses on reacting to and managing security events; it isn’t about creating disk images for evidence, which is forensic imaging; and it isn’t about preventing data loss, which is the role of data loss prevention.