200-201 practice question 1 of 35

What is a difference between SIEM and SOAR?

Answer options

A: SOAR predicts and prevents security alerts, while SIEM checks attack patterns and applies the mitigation.

B: SlEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response. Correct answer

C: SIEM predicts and prevents security alerts, while SOAR checks attack patterns and applies the mitigation.

D: SOAR's primary function is to collect and detect anomalies, while SIEM is more focused on security operations automation and response.

Correct Answer:

B. SlEM's primary function is to collect and detect anomalies, while SOAR is more focused on security operations automation and response.

Explanation

A Security Information and Event Management (SIEM) system's fundamental role is to aggregate and correlate log and event data from various sources across an organization's infrastructure. Its primary goal is to provide centralized visibility and detect anomalies, potential threats, and security incidents by analyzing this data against predefined rules. In contrast, a Security Orchestration, Automation, and Response (SOAR) platform is designed to ingest alerts (often from a SIEM) and automate the subsequent incident response actions. SOAR uses "playbooks" to orchestrate tasks across different security tools, thereby streamlining security operations and reducing manual intervention.

Why Incorrect

A. This incorrectly assigns prediction to SOAR and mitigation to SIEM. SIEM is for detection, while SOAR automates the response and mitigation actions.
C. This incorrectly states that SIEM predicts and prevents alerts. SIEM's core function is detection and alerting, not prevention.
D. This option reverses the roles of the two technologies. SIEM is for collection and detection, whereas SOAR is for automation and response. ---

References

1. Official Vendor Documentation (Cisco Press):

Santos

O. (2020). CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press. In Chapter 2

"The SOC

" the text distinguishes the technologies: "A SIEM system collects and analyzes security alerts

logs

and other real-time and historical data from security devices

network devices

endpoint

and servers... A security orchestration

automation

and response (SOAR) is a solution stack that allows an organization to collect data about security threats and respond to security events without human assistance." (pp. 46-47). This directly supports that SIEM is for collection/analysis (detection) and SOAR is for automated response.

2. Official Vendor Documentation (Cisco):

Cisco. (n.d.). What Is SOAR (Security Orchestration

Automation

and Response)? Cisco.com. Retrieved from https://www.cisco.com/c/en/us/products/security/what-is-soar.html. The document states

"SOAR platforms are a force multiplier for the security team... They do this by automating and orchestrating many of the manual

repetitive tasks that bog down security analysts." This confirms SOAR's focus on automation and response.

3. Official Vendor Documentation (Cisco):

Cisco. (n.d.). What Is SIEM (Security Information and Event Management)? Cisco.com. Retrieved from https://www.cisco.com/c/en/us/products/security/what-is-siem.html. This source clarifies SIEM's function: "SIEM software works by collecting log and event data... and bringing it together in a single centralized location. From there

the system sorts through the data and identifies and categorizes incidents and events." This highlights the collection and detection role of SIEM.

Keep practicing

Take the free 200-201 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test