A manufacturing company is deploying a SIEM system and uses an output-driven approach, starting with use cases addressing unauthorized access to production control systems. They configure data…

Question

Options

• AThe company can collect logs from non-critical systems.
• BThe company can create more complex use cases with greater scope.
• CThe SOC team can respond to all incidents in real time without delays.
• DThe SIEM system can automatically block all unauthorized access attempts.

• B
  90% (18)
• C
  5% (1)
• D
  5% (1)

Explanation

An output-driven SIEM deployment builds capability by starting with a narrowly defined, high-value detection outcome and then expanding once success is proven. The primary advantage is that it supports iterative growth into broader and more complex use cases with confidence. Each validated use case forces disciplined work on prerequisites: correct data onboarding, parsing, field normalization, baseline understanding, and tuning to reduce false positives. That foundation enables more advanced scenarios that require richer correlation (for example, linking identity events, network telemetry, endpoint behavior, and application logs) and often cover longer timelines or more complex workflows, such as supply chain disruption detection. Option A is not an advantage; collecting logs from non-critical systems may or may not be required depending on use cases. Option C is unrealistic because response speed depends on staffing and workflows, not only SIEM deployment strategy. Option D implies active prevention, which is not the SIEM’s core role (it can trigger automation, but blocking is not automatic by default). Therefore, the best advantage among the given options is enabling creation and expansion to more complex use cases with wider scope.

No community discussion yet for this question.