Which term describes monitoring that finds events after they have occurred?

• A. Passive monitoring
• B. Active monitoring
• C. Real-time
• D. Predictive

Answer: (A)

Monitoring that finds events after they have occurred relies on looking back at recorded data rather than actively probing the environment. Passive monitoring collects data from existing sources—logs, traffic captures, and sensor outputs—without injecting traffic or triggering responses. Because you’re analyzing these records after the fact, you can determine what happened, when, and how it unfolded, which is exactly what you need for post-incident review, forensics, and auditing. In contrast, active monitoring involves sending probes or synthetic transactions to test systems, real-time monitoring aims to detect events as they occur, and predictive monitoring uses trends to forecast future incidents.