Process Improvement CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company uses a SIEM, an EDR, and a ticketing system. The security team wants to automate the enrichment of incidents with EDR data. The team is considering two options: (1) configuring the SIEM to query the EDR API, or (2) having the EDR send all its alerts to the SIEM. Which consideration is most important when choosing between these two integration approaches?

   • AThe cost of the EDR API license versus the cost of additional SIEM storage.
   • BThe need to standardize the incident response process before implementing any integration.
   • CThe preference of the SOC analysts for one integration method over the other.
   • DThe SIEM's ability to query the EDR API on-demand versus the potential for increased data volume and noise from continuous alert forwarding.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A security team notices that analysts spend excessive time manually correlating alerts from different sources. Which technique directly helps streamline this operation?

   • AIncreasing the number of manual review steps
   • BDisabling all alert generation to reduce noise
   • CAutomating alert correlation with a security orchestration tool
   • DAssigning each analyst a separate tool to manage
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which action best exemplifies operations streamlining in a security operations center (SOC)?

   • AConsolidating multiple reporting templates into one standard format
   • BIncreasing the frequency of full manual audits of all logs
   • CRequiring analysts to manually enter data into three separate systems
   • DCreating a new approval step for every low-priority alert
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC manager wants to provide analysts with a unified view of security alerts from the SIEM, EDR, and cloud access security broker (CASB) without requiring them to switch between multiple dashboards. Which solution best fulfills this requirement?

   • AImplement a security orchestration, automation, and response (SOAR) platform that aggregates alerts from all sources into one console.
   • BDeploy a separate monitoring dashboard for each tool and train analysts on all of them.
   • CAsk the CASB vendor to provide a custom API for the EDR platform.
   • DConfigure the SIEM to only show alerts from itself and ignore EDR and CASB data.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses a vulnerability scanner, an EDR platform, and a SIEM. Currently, analysts must log into each console separately to correlate vulnerability findings with endpoint detections. Which integration strategy would most effectively reduce this manual correlation effort?

   • ASet up the SIEM to ingest logs and alerts from both the vulnerability scanner and the EDR platform.
   • BHave analysts use a spreadsheet to manually combine the outputs from all three tools.
   • CAsk the EDR vendor to add a built-in vulnerability scanner module.
   • DConfigure the vulnerability scanner to export reports to a shared network folder that analysts can access.
   Reveal Solution Discussion Select an answer first