Differentiating Global Endpoint Telemetry by Office
A global organization wants to manage all endpoint and user telemetry. The organization also needs to differentiate this data based on which office it is correlated to. Which of the following strategies best aligns with this goal?
Community Insight
The question tests whether you can separate the act of collecting telemetry at scale from the act of classifying it; the trap is picking centralized logging because it sounds like 'managing all telemetry,' when only labeling adds the per-office attribution the scenario demands.
This CAS-005 scenario asks how a global organization can centrally manage all endpoint and user telemetry while still distinguishing which office each data stream is correlated to. The page establishes that data labeling—attaching source metadata such as office, region, or business unit to each telemetry record at ingestion—is the strategy that satisfies both goals, while centralized logging alone only aggregates without differentiating.
The most common wrong answer is D, centralized logging. Learners equate 'manage all telemetry' with funneling logs into a single SIEM, but a SIEM full of untagged records cannot reliably be segmented by office—collection is not classification. A smaller share choose A, sensor placement, which affects collection coverage, not data differentiation.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B, data labeling, directly addresses the second half of the requirement: "differentiate this data based on which office it is correlated to." Labeling means stamping each telemetry stream or record with metadata attributes—office name, geographic region, business unit, asset tag—typically applied at the point of collection or ingestion. Once labeled, all endpoint and user telemetry can still flow into one management platform, but analysts can filter, segment, route, and retain data by office, which is exactly the differentiated correlation the organization needs. This also supports residency and privacy requirements, since labeled data can be partitioned by jurisdiction.
Why the Other Options Are Wrong
Option D, centralized logging, solves only the first clause: it gathers logs from everywhere into one location (a SIEM or log platform). As Sasha87 noted, "Centralized logging only means that all the logs are gathered at a single location, not that the logs are marked in any meaningful way," so it provides no built-in office attribution. Option A, sensor placement, concerns where collection infrastructure is physically or logically deployed; you could place sensors per office and still fail to differentiate the data if no labels are applied. Option C, continuous monitoring, is a program-level practice describing ongoing observation—it neither aggregates nor classifies telemetry and is far too broad to answer a specific data-organization question.
Community Comment Notes
The comments split, but the reasoning favors labeling. Sasha87 and jamestkd argue that labeling embeds source metadata ("Data labeling includes information like where it came from") so telemetry can be filtered and segmented by office. BigPapaFrank counters that the real mechanism is "metadata tagging, field tagging, or normalization in the SIEM" and calls data labeling a red herring; however, that description is essentially what data labeling means in this context—applying fields/tags at ingestion—so the objection collapses into option B rather than supporting D. lllllllhzade simply concurs that "Data labelling is correct."
Official Reference
Exam Strategy
Read which clause of the scenario each option actually satisfies. If the question adds a qualifier like 'differentiate,' 'attribute,' or 'segment,' the answer must be a classification or tagging mechanism, not a collection or aggregation mechanism.
Frequently Asked Questions
Why isn't centralized logging enough to differentiate telemetry by office?
Centralized logging only aggregates logs into one platform; without labels or source metadata, records from different offices are indistinguishable and cannot be reliably segmented.
How does data labeling help a global organization manage telemetry?
Labeling stamps each telemetry stream with attributes like office, region, or business unit at ingestion, allowing one unified system to filter, route, and retain data per office or jurisdiction.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →