Centralize log collection and correlate security events for detection and alerting is correct. A SIEM aggregates logs and telemetry from across servers, network devices, endpoints, cloud services and applications and it uses correlation and analytics to identify suspicious patterns and raise alerts.

The SIEM centralizes collection, normalizes different log formats and enriches events with context so that correlation rules and behavior analytics can detect complex threats that single sources would miss. It provides real time alerting, searchable event stores and tools for investigation and incident response which makes it the operational security monitoring backbone for a company like NovaLedger.

Manage network traffic and improve bandwidth utilization is incorrect because traffic management and bandwidth optimization are functions of network devices and WAN or SD WAN solutions. Those products shape and route traffic rather than analyze security telemetry.

Enable compliance reporting and audit trail generation is not the primary role even though SIEMs often help with audit trails and reports. Compliance reporting is a useful outcome of SIEM data, but the core purpose is detection, correlation and alerting rather than acting solely as a compliance reporting tool.

Provide endpoint protection and antivirus services is incorrect because endpoint protection is delivered by EDR and antivirus solutions. A SIEM receives logs and alerts from those endpoint agents and then correlates that data with other telemetry.

Full AWS Practitioner Certification Question