Exam CS0-003 topic 1 question 200 discussion

Actual exam question from CompTIA's CS0-003

Question #: 200
Topic #: 1

The Chief Information Security Officer for an organization recently received approval to install a new EDR solution. Following the installation, the number of alerts that require remediation by an analyst has tripled. Which of the following should the organization utilize to best centralize the workload for the internal security team? (Choose two.)

A. SOAR
B. SIEM
C. MSP
D. NGFW
E. XDR
F. DLP

Show Suggested Answer

Suggested Answer: AB 🗳️

by spamsoc at March 5, 2024, 5:35 p.m.

Comments

Submit Cancel

section8santa

Highly Voted 7 months ago

Selected Answer: AB

Trust used chatgpt

upvoted 6 times

...

Thunder_Cat

Most Recent 1 month ago

Selected Answer: BE

I don't know why the others are saying A. SOAR (security orchestration, automation, and response) does not focus on centralizing the workload. XDR (extended detection and reporting) extends EDR's capabilities which would help in correlate alerts and automate responses, ultimately helping the security team manage large volumes of alerts.

upvoted 1 times

f90ecff

2 weeks, 1 day ago

XDR – Extended detection and response is helpful but overlaps with EDR, not necessarily for centralizing workflows.

upvoted 1 times

...

spamsoc

8 months ago

A and B

upvoted 2 times

...

Exam CS0-003 All Questions

View all questions & answers for the CS0-003 exam