312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ79

VerifiedSecurity Operations and Management

A manufacturing company is deploying a SIEM system and aims to strengthen both security monitoring and regulatory compliance. During planning, the team chooses an output-driven approach, beginning with use cases that address unauthorized access to production control systems. They configure the data sources and alerts specific to that use case, ensuring actionable alerts without excessive false positives. After confirming its success, they proceed to use cases involving supply chain disruptions and malware detection. Which of the following best describes the main advantage of using an output-driven approach for SIEM deployment?

Explanation

An output-driven approach prioritizes defined security outcomes and builds the required data collection and alerting around each validated use case. This allows the deployment to grow iteratively from a focused, effective detection into broader and more complex use cases while controlling noise and implementation scope.

Community Discussion

No comments yet. Be the first to start the discussion!