イリノイ州シカゴの金融機関で発生したサイバー攻撃を受け、調査チームは複数の監視プラットフォームで生成された多数のアラートと重複したログエントリに圧倒されました。相関分析を試みる前に、チームはノイズを減らし分析効率を向上させるための手順を適用しました。この手順はどのようなアクションを表していますか?
正解:A
The correct answer is A because the step described is log and event reduction before correlation, which focuses on decreasing noise by filtering, compressing, or removing duplicate information. In the CHFI v11 blueprint, event correlation and event deconfliction are specifically listed under image and evidence examination, and that includes preparing data so analysts can identify meaningful patterns without being distracted by repetitive or irrelevant entries. Option B refers more to centralization or aggregation of logs, which can be useful, but it does not directly describe the action of reducing repeated entries. Option C concerns secure transmission and integrity protections during collection, which is unrelated to the analytical problem described. Option D points to normalization, where logs from different systems are transformed into a common structure, but the question is focused on reducing alert duplication and noise. From a forensic operations perspective, this preprocessing step improves the quality of later correlation by trimming the data to what matters most. That is why the best answer is the choice describing filtering, compression, and deletion of repeated entries.