Define SIEM and SOC and describe how a TA interacts with them during threat detection.

• A. SIEM aggregates logs and events; SOC monitors and responds; TA contributes attestation events, verifies data integrity, and ensures trusted data streams for analysis
• B. SIEM analyzes only application logs and ignores security events
• C. SOC is a storage service for logs
• D. TA replaces SIEM during threat detection

Answer: (A)

Understanding how SIEM and SOC work together with a Trusted Agent to ensure trusted data streams during threat detection is the idea here. A SIEM is the system that collects and normalizes logs and security events from many sources, then correlates them to reveal patterns that might indicate an incident. The Security Operations Center is the team and operating environment that continuously monitors those signals, analyzes alerts, and coordinates containment and response. The Trusted Agent adds a layer of trust by providing attestation evidence and verifying data integrity, so the data feeding the SIEM and the dashboards used by the SOC comes from trusted, tamper‑evident sources. This combination helps analysts rely on the provenance of the data, reduces the risk of manipulated logs skewing results, and supports more accurate threat detection. The other options misstate roles—SIEM doesn’t ignore security events, SOC isn’t just a storage service, and the Trusted Agent doesn’t replace the SIEM.