 Sources for Security Metrics:

Metrics must derive from systems that monitor and enforce baseline defenses.

Firewalls, anti-virus consoles, IDS, and syslog provide comprehensive insights into threats, events, and compliance.

 Why This is Correct:

Covers both perimeter defenses (firewall) and endpoint protection (anti-virus).

IDS monitors threats in real-time, while syslog centralizes logs for analysis.

 Why Other Options Are Incorrect:

A. Servers, routers, switches, modem: Focuses on hardware, not security metrics.

B. Firewall, exchange, web server, IDS: Exchange and web servers are application-specific.

D. IDS, syslog, router, switches: Misses critical endpoints like firewalls and anti-virus.

 References:

EC-Council emphasizes leveraging these tools for creating meaningful and actionable security metrics.