Câu 30: 312-39V2: Certified SOC Analyst (CSA) v2

A manufacturing company is deploying a SIEM system and wants to improve both its security monitoring and regulatory compliance capabilities. During the planning phase, the team decides to use an output-driven approach, starting with use cases that address unauthorized access to production control systems. They configure data sources and alert specific to this use case, ensuring they receive actionable alerts without excessive false positives. After validating its success, they move on to use cases related to supply chain disruptions and malware detection. Which of the following best describes the primary advantage of using an output-driven approach in SIEM deployment?

1. A. The company can create more complex use cases with greater scope. — đáp án hiện tại
2. B. The company avoids the need to collect logs from non-critical systems.
3. C. The SIEM system can automatically block all unauthorized access attempts.
4. D. The SOC team can respond to all incidents in real time without delays.