CompTIA Security+ (SY0-701)Security OperationsHard
A security engineer writes a script that automatically queries a threat intelligence API, cross-references indicators of compromise against SIEM logs, and generates a ticket if a match is found, all without human intervention. Which benefit of security automation does this scenario primarily demonstrate?
- AElimination of the need for a SIEM platform
- BReduced mean time to detect through consistent, repeatable analysis
- CReplacement of the incident response team
- DGuaranteed prevention of all future breaches
Show answer & explanationAnswer & explanation
Correct answer: B. Reduced mean time to detect through consistent, repeatable analysis
Automating repetitive correlation tasks like IOC matching allows for faster, consistent detection of threats than manual analysis, directly reducing mean time to detect (MTTD) by removing delays caused by manual investigation.
Why the other options are wrong
- A. The scenario still relies on the SIEM as the log source; automation complements rather than replaces it.
- C. Automation augments analyst workflows rather than replacing the IR team entirely.
- D. Automation improves detection speed but cannot guarantee prevention of all breaches.
Security Automation Benefits
Using scripts or orchestration tools to perform repetitive security tasks automatically, improving speed and consistency of detection and response.
- Reduces mean time to detect (MTTD) and respond (MTTR)
- Frees analysts for higher-value investigative work
- Requires reliable data sources and defined logic to avoid errors
Memory trick: Automation speeds detection, doesn't replace defenders.