hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A SOC team is implementing a security monitoring…
A SOC team is implementing a security monitoring solution for a cloud-based infrastructure. Which of the following is the most important consideration for effective monitoring?
⚠ Common exam trap
Cisco often tests the misconception that encryption or cost-saving measures are the top priority in monitoring, when in fact the foundational requirement is complete visibility through centralized logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Centralized logging from all cloud services and on-premises.
Centralized logging is the most important consideration because it provides a single, unified view of security events across all cloud services and on-premises infrastructure. Without aggregation, the SOC cannot correlate events, detect distributed attacks, or perform effective threat hunting. This aligns with the principle of 'visibility first' in security monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Centralized logging from all cloud services and on-premises.
Why this is correct
Centralized logging enables correlation and consistent analysis across the infrastructure.
- ✗
Encrypting all logs at rest.
Why it's wrong here
Encryption is important for security but not the primary consideration for monitoring effectiveness.
- ✗
Reducing log retention to save cost.
Why it's wrong here
Short retention hampers forensic investigations and compliance.
- ✗
Using only native cloud monitoring tools.
Why it's wrong here
Native tools may not provide comprehensive visibility across hybrid environments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.