Free Preparation Discussions
MENU
Cisco 300-745 Exam - Topic 3 Question 9 Discussion
Topic #: 3
Which tool must be used to prioritize incidents by a SOC?
A Security Operations Center (SOC) is often overwhelmed by thousands of alerts from various security tools. The primary tool used to aggregate, correlate, and---most importantly---prioritize these incidents is the Security Information and Event Management (SIEM) system. According to the Cisco SDSI domain on Risk, Events, and Requirements, a SIEM acts as the central brain of the SOC.
A SIEM (such as Splunk or Cisco Secure Cloud Analytics) ingests logs from firewalls, endpoints, and cloud services. It uses correlation rules and risk-scoring algorithms to distinguish between low-priority 'noise' and critical security incidents. For example, a single failed login might be ignored, but ten failed logins followed by a successful one and a large data transfer would be escalated as a high-priority incident. Endpoint Detection and Response (EDR) (Option B) and Endpoint Protection Platforms (EPP) (Option D) provide deep visibility and protection on individual hosts but lack the cross-platform correlation needed to prioritize organizational risk. CloudWatch (Option C) is a monitoring service for AWS resources but does not function as a multi-source security correlation engine. By using a SIEM, SOC analysts can focus their limited time on the most impactful threats, ensuring a more efficient and effective incident response process.
========
Lashaunda
3 days agoJerlene
8 days agoJarvis
13 days agoLeonor
19 days agoLaticia
24 days agoAlayna
29 days agoLashaunda
1 month agoJerlene
1 month agoLavina
1 month agoJusta
2 months agoLaquanda
2 months agoRefugia
2 months agoHayley
2 months agoVictor
2 months agoCristal
4 months agoAdell
4 months agoRaymon
4 months ago