CAS-001 Question #314: Real Exam Question with Answer & Explanation

Question

Options

• AImplement a security operations center to provide real time monitoring and incident response with self
• BImplement an aggregation based SIEM solution to be deployed on the log servers of the major platforms,
• CImplement a security operations center to provide real time monitoring and incident response and an
• DEnsure that the network operations center has the tools to provide real time monitoring and incident
• EImplement an agent only based SIEM solution to be deployed on all major platforms, applications, and
• FEnsure appropriate auditing is enabled to capture the required information.
• GManually pull the logs from the major platforms, applications, and infrastructures to a central secure server.

Explanation

Answer B (aggregation-based SIEM on log servers) is correct because an aggregation-based approach collects and normalizes logs from existing log servers without deploying heavy agents on every production system, satisfying the performance constraint. Answer C (SOC with real-time monitoring and incident response) addresses the real-time incident reporting requirement and provides the human analysis layer the SIEM data feeds into. Answer F (enable appropriate auditing) is foundational - without proper audit logging configured on platforms and databases, no SIEM has meaningful data to collect. Answer A's 'self-service' SOC lacks enterprise rigor. Answer E (agent-only SIEM) would impact performance on production systems. Answer G (manual log pulls) violates real-time requirements. Answer D (network operations center only) lacks the security-specific tooling needed.

No community discussion yet for this question.