CS0-003 Question 23

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  MTTD is the best metric to focus on after investing in SIEM, SOAR, and ticketing, because these tools are specifically designed to reduce detection time through correlation, automation, and streamlined workflows. By measuring how quickly threats are identified, the organization can directly evaluate whether these new technologies are improving the speed and effectiveness of its security operations.

• Chose C2

  Mean time to detect is certainly a good metric for the overall investment, but for a new implementation I would argue that optimising the alert volume is certainly the most important and critical element to look at: removing false positives and configuring relevant correlations.

• 2

  I think you're looking at the question incorrectly, they don't need to optimize yet; they want to know if the SIEM/SOAR system is providing ROI....of course alert count will be there, b/c that's what it does. But the point of the system is to detect threats FASTER; MTTD is the metric that validates whether or not the system is providing that ROI