CS0-003 · Question #430
An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for the security analyst…
The correct answer is C. Use a vendor-provided API to automate pulling the logs in real time. Using a vendor-provided API to automate pulling logs in real-time is the best option for improving the efficiency of security operations when the financial application does not allow event logging to send to the corporate SIEM. This approach ensures that logs are consistently…
Question
An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?
Options
- AConfigure a new SIEM specific to the management of the hosted environment.
- BSubscribe to a threat feed related to the vendor's application.
- CUse a vendor-provided API to automate pulling the logs in real time.
- DDownload and manually import the logs outside of business hours.
How the community answered
(49 responses)- A6% (3)
- B4% (2)
- C73% (36)
- D16% (8)
Explanation
Using a vendor-provided API to automate pulling logs in real-time is the best option for improving the efficiency of security operations when the financial application does not allow event logging to send to the corporate SIEM. This approach ensures that logs are consistently and promptly integrated into the security monitoring process without manual intervention, enhancing the overall effectiveness of security operations.
Topics
Community Discussion
No community discussion yet for this question.