Discuss Cisco 100-160 Exam Topic 1 Question 3

You need a software solution that performs the following tasks:

Compiles network data

Logs information from many sources

Provides orchestration in the form of case management

Automates incident response workflows

What product should you use?

ASIEM

BSOAR

CNextGen IPS

DSnort

Suggested Answer: B

The CCST Cybersecurity Study Guide explains that SOAR (Security Orchestration, Automation, and Response) platforms integrate data from multiple tools and sources, support case management, and automate security workflows for faster incident response.

'SOAR solutions provide orchestration, automation, and response capabilities. They collect security data from multiple systems, enable analysts to manage incidents, and automate repetitive tasks in the response process.'

(CCST Cybersecurity, Incident Handling, Security Automation Tools section, Cisco Networking Academy)

A (SIEM) collects and correlates security logs but lacks full orchestration and automated response capabilities.

B is correct: SOAR adds orchestration, case management, and automated incident response.

C (NextGen IPS) focuses on intrusion prevention, not orchestration.

D (Snort) is an open-source intrusion detection/prevention tool, not an orchestration platform.

Get Premium 100-160 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

23 comments · newest first

Rachael 9 months ago

Snort is great, but it doesn't do case management like the others.

Noemi 10 months ago

Wait, can SOAR really handle all those tasks?

Jolanda 10 months ago

I think SOAR is the better choice for automation!

Juan 11 months ago

NextGen IPS is more about prevention, not orchestration.

Amber 11 months ago

Definitely a SIEM for logging and data compilation.

Junita 11 months ago

Snort is great for intrusion detection, but it definitely doesn't cover all the orchestration and logging aspects mentioned in the question.

Yuette 11 months ago

I feel like NextGen IPS could be relevant, but it seems more focused on prevention rather than incident response automation.

Kati 12 months ago

I remember studying SIEM solutions for logging and compiling data, but they don't really handle orchestration like case management, right?

Beatriz 12 months ago

I think the answer might be SOAR since it focuses on automating incident response workflows, but I'm not entirely sure.

Anisha 12 months ago

I'm a little confused by the options. NextGen IPS and Snort seem more focused on intrusion prevention, which isn't the main requirement here. I think I'll rule those out and focus on comparing SIEM vs SOAR to determine the best fit.

Filiberto 1 year ago

Okay, let's see. SIEM handles log aggregation and analysis, but doesn't necessarily provide the orchestration and automation features mentioned. SOAR seems like the more comprehensive solution that meets all the needs described in the question. I'm leaning towards that as the best answer.

Elinore 1 year ago

Hmm, I'm a bit unsure about this one. The requirements seem to overlap with both SIEM and SOAR capabilities. I'll need to think through the differences between those two solutions more carefully before deciding.

Levi 1 year ago

This looks like a pretty straightforward question. I'd say the answer is SOAR, since it covers all the key requirements like compiling network data, logging from multiple sources, providing case management, and automating incident response.

Noah 1 year ago

I think the answer is A) SIEM because it can compile network data and log information from many sources.

Vonda 1 year ago

Snort? Really? That's an intrusion detection system, not a comprehensive solution for all these requirements. Clearly SIEM or SOAR is the way to go.

Felix 1 year ago

Hmm, I'm not sure SIEM or SOAR is the right answer. NextGen IPS might be more suitable for the network data compilation and incident response aspects.

William 1 year ago

I'd go with SOAR. It's designed specifically for orchestration and automation, which is key for the case management and incident response workflows needed here.

Audra 10 months ago

↳ replying to William

SIEM could work, but SOAR is more focused on orchestration.

Gearldine 10 months ago

↳ replying to William

Agreed! Automation is crucial for incident response.

Graciela 10 months ago

↳ replying to William

I think SOAR is the best choice too. It really streamlines processes.

Dominga 11 months ago

↳ replying to William

Definitely SOAR! It handles everything we need efficiently.

Rima 1 year ago

SIEM seems like the best fit for the requirements listed. It can handle all the tasks mentioned, like compiling network data, logging from multiple sources, and automating incident response workflows.

Jose 1 year ago

↳ replying to Rima

I agree, SIEM is definitely the way to go for those tasks.

Cisco 100-160 Exam - Topic 1 Question 3 Discussion