312-39V2: Certified SOC Analyst v2

Question

An organization with a complex IT environment plans to implement a SIEM solution to strengthen its threat-detection and response capabilities. Because of the scale and complexity of its systems, the organization chooses a phased deployment approach to support a smooth implementation and reduce potential risks. Which of the following should be the initial phase of its SIEM deployment strategy?

Explanation

Log management establishes the telemetry foundation required by a SIEM: collecting, centralizing, retaining, and making security-event data available for analysis. Security analytics, UEBA, and incident-response automation depend on those logs, so they should follow log-management deployment. Microsoft describes telemetry collection as the foundation of a SIEM deployment.

Learn more

Microsoft Sentinel skill-up training — data collection

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ28

Community Discussion