Which of the following is NOT typically considered a core component of a FOSSE logging and auditing strategy?

• A. Centralized log collection
• B. Tamper-evident storage
• C. Real-time video surveillance
• D. Log correlation across systems

Answer: (C)

This question tests what elements belong in a FOSSE logging and auditing strategy. Centralized log collection pulls logs from across systems into one place, which is essential for unified monitoring and investigation. Tamper-evident storage protects the integrity of those logs so they can be trusted during audits and after incidents. Log correlation across systems enables you to connect events from different sources, constructing a coherent incident timeline and spotting cross-system patterns.

Real-time video surveillance, while valuable for physical security and incident context, does not by itself provide an audit trail or cross-system log analysis, so it isn’t considered a core element of a logging and auditing strategy. It can complement security efforts, but the logging framework centers on collecting, securing, and correlating digital logs.