CompTIA Security+ SY0-701 (V7) Practice Question

The primary role of monitoring in relation to indicators within a security infrastructure is to identify unusual patterns or behavior that may signify a security incident. While it might also help in enforcing policy by triggering alerts when anomalies are detected, and can be instrumental in retrospective analysis after an incident, its essential function centers on the prompt detection of potentially malicious activity. Understanding the nuances of monitoring's main role is important in distinguishing it from ancillary benefits such as policy enforcement or post-incident analysis.