What is the primary role of SIEM in cloud security?

• A. Collects security events and enables detection and forensics
• B. Replaces the firewall
• C. Only stores historical data
• D. Manages identity and access provisioning

Answer: (A)

SIEM in cloud security focuses on turning scattered security data into actionable insight: it gathers security events from across cloud services and workloads, normalizes and correlates them, and provides real-time detection, alerts, and forensic capabilities. This centralized view lets you identify complex attack patterns that span multiple systems, investigate incidents, and reconstruct the sequence of events for root-cause analysis. It’s about detection and investigation, not just storing data or enforcing access.

Not a firewall replacement—the firewall is a preventive control at the network edge, while SIEM analyzes events from that and other sources to detect incidents. It’s more than a storage tool, since its value lies in analysis, correlation, and alerting. And it doesn’t manage identity provisioning—identity and access management are handled by IAM systems, not SIEM.