200-201 Question 11

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  • SOAR is defined as an advanced layer that incorporates explicit threat and vulnerability management workflows, leveraging automated playbooks to remediate and track these exposures over time. • SIEM, by contrast, is categorized strictly as a system for log ingestion, aggregation, correlation, and alerting.

• Chose D1

  SIEM (Security Information and Event Management): Primary Function: Collects, stores, and analyzes security event logs from various systems to detect threats, provide alerts, and help security teams with incident investigation. Purpose: SIEM is focused on monitoring, logging, and event correlation. It helps with real-time threat detection and incident response by aggregating logs and providing insights based on the collected data. SOAR (Security Orchestration, Automation, and Response): Primary Function: Automates and orchestrates the security response process. It helps security teams respond to incidents quickly by automating tasks like blocking IP addresses, isolating systems, and executing predefined playbooks. Purpose: SOAR is used to streamline workflows, automate repetitive actions, and integrate with various security tools (including SIEM) to ensure rapid and coordinated responses to incidents.

• Chose D1

  I think the correct answer is D