1.2 Compare Security Deployments 200-201 Practice Questions (Page 12)

Questions 56–58

1. 56expert · hard

   A SOC manager is evaluating tools to improve incident response. The team currently uses a SIEM for log aggregation and correlation, but analysts spend significant time manually performing repetitive tasks like querying threat intelligence and blocking malicious IPs. The manager wants to reduce this manual effort while keeping the SIEM as the primary alerting tool. Which approach should the manager take?

   • AAdd more analysts to handle the manual tasks
   • BReplace the SIEM with a more advanced log management tool
   • CIntegrate a SOAR platform with the SIEM to automate enrichment and response playbooks
   • DConfigure the SIEM to automatically block IPs without human review
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is a key benefit of agent-based security software installed on an endpoint?

   • AIt provides deep visibility into endpoint processes, files, and system activity
   • BIt requires no management or updates
   • CIt eliminates the need for network security monitoring
   • DIt can only monitor network traffic, not local activities
   Reveal Solution Discussion Select an answer first
3. 58foundation · easy

   Why is log retention important for compliance?

   • ABecause logs are used to configure network firewalls
   • BBecause regulations often require logs to be kept for a specified period for audit purposes
   • CBecause logs must be deleted immediately after an incident
   • DBecause logs are needed to encrypt data at rest
   Reveal Solution Discussion Select an answer first