Security orchestration, automation, and response (SOAR) platforms are specifically designed to react to security information and perform workflows across a variety of other systems, which would make it the best choice. Security information and event management (SIEM) platforms are capable of doing this to some degree, but they are not as well suited to the task as SOAR platforms, so while SIEM might be a good answer, it’s not the best possible answer. When you take a security certification exam, it’s very important to remember that questions may have one or more possible answers. You always want to choose the best of those choices. That’s why it’s very important to read the entire question carefully!

Cloud access security brokers (CASB) and intrusion prevention systems (IPS) are not designed for correlating and responding to security information. CASB systems enforce security policies across cloud environments while an IPS is designed to detect and block intrusions.