Which of the following is listed among recovery models?

• A. Centralized Logging (SIM/SIEM)
• B. Enhanced Network Visibility
• C. Establish Security Awareness Training Program
• D. Improve Network Performance

Answer: (A)

Centralized logging is essential in recovery because, after an incident, you need a complete, reliable record of what happened to understand the attack, validate what needs to be restored, and verify that systems are clean before returning to normal operation. A centralized log repository, often implemented as a SIEM/SIM, collects and preserves events from across the environment, allowing you to reconstruct timelines, identify affected assets, and confirm that remediation steps were effective. This single source of truth supports post-incident forensics, compliance reporting, and informed decision-making during restoration.

The other options focus more on prevention, detection, or performance rather than the recovery process. Enhanced network visibility aids understanding of the current state during an incident, security awareness training reduces human risk, and improving network performance targets efficiency and reliability but does not directly support the recovery-and-restore phase like centralized logging does.