Cybersecurity and Response Planningintermediate
What is the main distinction between EDR telemetry and a SIEM system?
Answer
EDR records endpoint activity; a SIEM correlates logs from diverse sources.
Explanation
### Why this is right
EDR focuses on endpoint activity and telemetry, while a SIEM aggregates and correlates information from different sources.
### The concept
Endpoint telemetry can feed a larger correlation platform. The technologies can complement each other rather than compete.
### The other options
- **B. EDR restores backups; a SIEM patches endpoints.**: describes neither tool's central purpose.
- **C. EDR is a legal role; a SIEM is a response policy.**: confuses technologies with organizational roles and governance.
- **D. EDR captures only full packets; a SIEM records no logs.**: misstates both tools' data use.
### Remember
EDR watches endpoints; SIEM correlates across sources.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free