mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Reduce the mean time to detect (MTTD) for…
A company wants to reduce the mean time to detect (MTTD) for security incidents. Which technology is most effective for this purpose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security information and event management (SIEM) with behavior analytics
A SIEM with User and Entity Behavior Analytics (UEBA) is most effective for reducing MTTD because it baselines normal behavior and detects anomalies in real time, enabling early detection of threats. Full disk encryption (B) protects data at rest but does not aid detection. A DLP system (C) focuses on preventing data exfiltration, not broad detection. A NIDS (D) relies on signature matching, which can miss novel or subtle attacks and typically has a higher detection latency than behavior analytics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security information and event management (SIEM) with behavior analytics
Why this is correct
SIEM with UEBA provides real-time correlation and anomaly detection, reducing MTTD.
- ✗
Full disk encryption software
Why it's wrong here
Encryption protects data at rest but does not aid detection.
- ✗
Data loss prevention (DLP) system
Why it's wrong here
DLP prevents data exfiltration but does not primarily reduce detection time.
- ✗
Network-based intrusion detection system (NIDS)
Why it's wrong here
NIDS detects known signatures but may miss novel attacks and does not reduce MTTD significantly.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.