Exam CAS-005 topic 1 question 28 discussion

Question only mentions maintain confidentiality : E. Configure SOAR to monitor and intercept files and data leaving the network A SOAR (Security Orchestration, Automation, and Response) system can automate data loss prevention (DLP) actions. Monitoring and intercepting data exfiltration adds an additional layer of confidentiality assurance, particularly in a dynamic environment

The best choices for ensuring data confidentiality in a dynamic, low-risk environment are: **D. Encrypt all data and files at rest, in transit, and in use.** Encryption is fundamental to protecting sensitive data from unauthorized access. By encrypting data at all stages—whether stored, transmitted, or actively used—organizations can significantly reduce the risk of exposure. **F. Implement file integrity monitoring.** File integrity monitoring helps detect unauthorized changes to sensitive files, ensuring that data remains unaltered and secure. This is particularly useful for identifying potential breaches or insider threats. While **C. Installing SIEM within a SOC** is valuable for security monitoring, it primarily focuses on threat detection rather than directly ensuring confidentiality. **E. Configuring SOAR to monitor and intercept files** can help prevent data leaks, but encryption and integrity monitoring provide more direct assurance of confidentiality. Would you like recommendations on specific tools or implementation strategies?