SY0-701 Security Architecture Practice Question
A security operations center (SOC) analyst is overwhelmed by the volume of alerts. The management wants to implement a solution that can automatically respond to common threats, such as blocking an IP address or isolating a compromised endpoint, without requiring human intervention. Which of the following technologies best meets this requirement?
⚠ Common exam trap
Test-takers frequently confuse SIEM's alerting capability with automated response, forgetting that SIEMs require a separate SOAR or custom scripting to perform actions, while SOAR is the dedicated solution for orchestrated, automated remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security Orchestration, Automation, and Response (SOAR)
SOAR is the correct choice because it is specifically designed to automate response actions to common security incidents, such as blocking an IP address via firewall APIs or isolating an endpoint through EDR integration, without requiring human intervention. This directly addresses the SOC analyst's alert fatigue by enabling playbook-driven, automated remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Information and Event Management (SIEM)
Why it's wrong here
A SIEM excels at centralizing log collection and generating security alerts through correlation rules, but it does not natively execute response actions against those findings. Analysts must still investigate the raw logs, manually validate threats, and carry out containment or remediation steps through separate tools. While a SIEM can feed data into another automation layer, its core function remains visibility and detection, not autonomous response, so it would not alleviate the analyst's manual workload.
When this WOULD be correct
A question asking for a solution to centralize log collection, correlate events across sources, and provide real-time alerting for security incidents, without requiring automated response, would make SIEM the correct answer.
- ✓
Security Orchestration, Automation, and Response (SOAR)
Why this is correct
SOAR platforms are purpose-built to aggregate alerts from multiple sources, execute predefined playbooks, and automatically trigger response actions such as containing a host, blocking an IoC, or opening a ticket. By orchestrating workflows across disparate security tools (e.g., SIEM, EDR, firewalls), SOAR directly reduces the manual triage and repetitive tasks that overwhelm analysts. This capability to automate complex, multi-step incident response without human intervention makes it the exact fit for the scenario.
- ✗
Endpoint Detection and Response (EDR)
Why it's wrong here
Endpoint Detection and Response (EDR) tools monitor host-level activity and can automate certain response actions like quarantining a file or isolating an endpoint from the network. However, these automated responses are confined to endpoint processes, lacking the broader orchestration across identity, network, cloud, and other security controls that the scenario demands. EDR is a component within a response ecosystem, not a platform that coordinates and automates an entire multi-tool incident response workflow.
When this WOULD be correct
An exam question asking for a technology that provides continuous monitoring, detection, and manual or automated response specifically on endpoint devices, such as identifying malware or suspicious processes on a laptop, would make EDR the correct answer.
- ✗
Cloud Access Security Broker (CASB)
Why it's wrong here
A Cloud Access Security Broker (CASB) enforces policies for sanctioned cloud applications, such as access controls, data loss prevention, and shadow IT discovery, by sitting between users and cloud providers. Its automation features are tailored to cloud-specific policy enforcement—not to orchestrating enterprise-wide incident response actions across networks, endpoints, and other infrastructure. Because the analyst's overload concerns general security monitoring and response, a CASB addresses a narrow cloud governance niche rather than the broader automation gap.
When this WOULD be correct
A question asking for a technology that monitors and controls access to cloud applications, enforces data loss prevention policies, and detects shadow IT in a multi-cloud environment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Security Orchestration, Automation, and Response (SOAR)Correct answer▾
Why this is correct
SOAR platforms are purpose-built to aggregate alerts from multiple sources, execute predefined playbooks, and automatically trigger response actions such as containing a host, blocking an IoC, or opening a ticket. By orchestrating workflows across disparate security tools (e.g., SIEM, EDR, firewalls), SOAR directly reduces the manual triage and repetitive tasks that overwhelm analysts. This capability to automate complex, multi-step incident response without human intervention makes it the exact fit for the scenario.
✗Security Information and Event Management (SIEM)Wrong answer — click to see why▾
Why this is wrong here
SIEM aggregates and correlates logs for analysis but lacks native automated response capabilities; it requires human intervention or integration with other tools to block IPs or isolate endpoints.
★ When this WOULD be the correct answer
A question asking for a solution to centralize log collection, correlate events across sources, and provide real-time alerting for security incidents, without requiring automated response, would make SIEM the correct answer.
Why candidates choose this
Candidates often associate SIEM with security monitoring and incident response, mistakenly believing its alerting features include automated remediation, overlooking that SOAR specifically adds orchestration and automation.
✗Endpoint Detection and Response (EDR)Wrong answer — click to see why▾
Why this is wrong here
EDR focuses on detecting and investigating threats on endpoints, but it does not inherently provide automated response orchestration across multiple security tools to block IPs or isolate endpoints without human intervention.
★ When this WOULD be the correct answer
An exam question asking for a technology that provides continuous monitoring, detection, and manual or automated response specifically on endpoint devices, such as identifying malware or suspicious processes on a laptop, would make EDR the correct answer.
Why candidates choose this
Candidates may confuse EDR's automated response capabilities (like isolating an endpoint) with the broader orchestration and automation across multiple systems that SOAR provides, overlooking the need for cross-platform automation.
✗Cloud Access Security Broker (CASB)Wrong answer — click to see why▾
Why this is wrong here
CASB is designed to enforce security policies for cloud services, not to automate response actions like blocking IPs or isolating endpoints across the enterprise.
★ When this WOULD be the correct answer
A question asking for a technology that monitors and controls access to cloud applications, enforces data loss prevention policies, and detects shadow IT in a multi-cloud environment.
Why candidates choose this
Candidates may confuse CASB's policy enforcement capabilities with automated response, or think it can handle endpoint isolation due to its security control features.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Firewall Types and Deployment
Key term
Security operations center
A Security Operations Center (SOC) is a centralized team and facility that monitors, detects, analyzes, and responds to cybersecurity incidents across an organization's IT environment 24/7.
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.