Cisco Exam 200-201 Topic 1 Question 82 Discussion

Actual exam question for Cisco's 200-201 exam

Question #: 82
Topic #: 1

What is a difference between SI EM and SOAR security systems?

ASOAR ingests numerous types of logs and event data infrastructure components and SIEM can fetch data from endpoint security software and external threat intelligence feeds

BSOAR collects and stores security data at a central point and then converts it into actionable intelligence, and SIEM enables SOC teams to automate and orchestrate manual tasks

CSIEM raises alerts in the event of detecting any suspicious activity, and SOAR automates investigation path workflows and reduces time spent on alerts

DSIEM combines data collecting, standardization, case management, and analytics for a defense-in-depth concept, and SOAR collects security data antivirus logs, firewall logs, and hashes of downloaded files

Show Suggested Answer

Suggested Answer: C

by Paz at Mar 20, 2024, 08:44 AM

Limited Time Offer

25%

Off

Get Premium 200-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rodrigo

5 days ago

Exactly! I was leaning towards B as well. Plus, option C just sounds wrong - SIEM systems are the ones that raise alerts, not SOAR.

upvoted 0 times

...

Arletta

6 days ago

That makes sense to me. SOAR is about the collection and analysis, while SIEM is about the automation and response. We need both in a comprehensive security strategy.

upvoted 0 times

...

Lawrence

7 days ago

Haha, yeah, that one was a bit of a head-scratcher. I can just picture a SOAR system being like, 'Nah, I'm not going to alert you to that suspicious activity. I'll just handle it myself!'

upvoted 0 times

...