ISC2 CC Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Blocking malicious network traffic

  Why it's wrong here

  Blocking traffic is performed inline by a firewall or IPS, which sits in the packet path and drops flows; a SIEM passively collects and correlates logs, alerting analysts after the fact. It is tempting because SIEM alerts often trigger automated blocking via integration, but the blocking itself is the firewall's action, not the SIEM's.

• ✓

  Correlating log data from multiple sources to identify security incidents

  Why this is correct

  SIEM platforms aggregate and normalise logs from disparate sources, then apply correlation rules to link related events across systems. This cross-source correlation is what surfaces incidents that isolated log review would miss, satisfying the question's requirement for a key SIEM function.

• ✗

  Enforcing password complexity requirements

  Why it's wrong here

  Password complexity is enforced by directory policy engines such as Microsoft Entra ID or Active Directory Group Policy at authentication time. A SIEM only ingests the resulting audit events and raises alerts on failed logons; it cannot set or apply credential rules. It is tempting because SIEMs do report weak-password and brute-force activity.

• ✗

  Patching vulnerabilities in operating systems

  Why it's wrong here

  Patching is executed by endpoint or vulnerability management tooling that deploys updates to hosts. A SIEM aggregates and correlates logs, including patch-compliance events, but holds no remediation agent and cannot install software. It is tempting because SIEM dashboards surface missing-patch data, which is reporting, not the patching action itself.

Go deeper

Related to this question