Nightly log review by SOC analysts is framed as which control category, distinct from the SIEM product itself?
Select an answer to reveal the explanation.
Short Explanation
The SIEM box is the power tool; the analyst actually reading the alerts every night is the craftsperson using it. Tools are technical; people-running-a-process is operational. Keep those two shelves labeled differently on the exam.
Full Explanation
Operational controls are executed by people following processes, such as scheduled log review, security awareness delivery, or incident handling procedures. The SIEM platform that collects and correlates events is a technical control. Distinguishing the human review process from the technology product is required under SY0-701 control-category mapping. Location of the SOC room does not make the review a physical control, and a policy title alone does not convert the nightly activity into a managerial-only control.