What is the primary focus of NIST SP 800-92?

• A. Log Management
• B. Network intrusion detection
• C. Identity and access management
• D. Encryption key management

Answer: (A)

NIST SP 800-92 focuses on how to handle logs effectively to support security operations. It covers collecting logs from endpoints, servers, and devices, centralizing them in a secure and tamper-evident repository, ensuring proper protection and retention, and enabling analysis to detect, investigate, and respond to incidents. The goal is to have a reliable log management program where logs are complete, time-consistent, accessible, and usable for forensics and auditing.

Other topics like detecting intrusions, managing who can access systems, or safeguarding encryption keys are important in security, but they are addressed in different guidelines. The primary emphasis of SP 800-92 is the lifecycle and governance of log data and its use in monitoring and incident response.