An organization is having difficulty correlating events from its individual AV, EDR, DLP, SWG, WAF, MDM, HIPS, and CASB systems. Which of the following is the best way to improve the situation?
A.
Remove expensive systems that generate few alerts.
B.
Modify the systems to alert only on critical issues.
C.
Utilize a SIEM to centralize logs and dashboards.
A SIEM is a centralized solution that aggregates and correlates log data from multiple security devices, applications, and systems in real-time. It provides a unified view of security events and alerts, making it easier for security analysts to detect and respond to security incidents. With a SIEM, the organization can create custom dashboards, perform advanced analytics, and automate incident response workflows.
This section is not available anymore. Please use the main Exam Page.SY0-601 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
ApplebeesWaiter1122
Highly Voted 1 year, 9 months agoandresalcedo
Most Recent 1 year, 9 months ago