Exam CISM topic 1 question 905 discussion

In other words, Threat Hunting Activities. This can indeed be achevied with proper tooling, and SIEM.

best way to detect APT is monitor for as abnormalities. SIEM can help on this.

C: C. Search for anomalies in the environment is generally the better approach. Here’s why: Anomaly Detection: APTs are designed to evade traditional security measures and blend in with regular network activity. By searching for anomalies—unusual patterns or behaviors in network traffic, system usage, or data access—you can identify potential signs of an APT that might not fit established patterns of normal activity. This proactive monitoring helps in detecting sophisticated threats that are specifically crafted to evade standard detection methods.

it shlould be D

C. Search for anomalies in the environment.