Exam CS0-003 topic 1 question 273 discussion

Actual exam question from CompTIA's CS0-003

Question #: 273
Topic #: 1

An organization has a critical financial application hosted online that does not allow event logging to send to the corporate SIEM. Which of the following is the best option for the security analyst to configure to improve the efficiency of security operations?

A. Configure a new SIEM specific to the management of the hosted environment.
B. Subscribe to a threat feed related to the vendor's application.
C. Use a vendor-provided API to automate pulling the logs in real time.
D. Download and manually import the logs outside of business hours.

Show Suggested Answer

Suggested Answer: C 🗳️

by ChopSNap at Nov. 19, 2024, 3:59 a.m.

Comments

Submit Cancel

ChopSNap

Highly Voted 7 months, 1 week ago

Selected Answer: C

C. Use a vendor-provided API to automate pulling the logs in real time. This approach offers several advantages: Real-time monitoring: By pulling logs in real time, the security analyst can immediately detect and respond to threats. Automation: Automating the log collection process reduces manual effort and the risk of human error. Integration with existing SIEM: The collected logs can be integrated with the existing SIEM, allowing for centralized monitoring and analysis.

upvoted 5 times

...