A manufacturing company is deploying a SIEM system and wants to improve both security monitoring...

An output-driven SIEM approach starts with clearly defined outcomes (use cases) and then works backward to ensure the right data sources, parsing, and detection logic are implemented for those outcomes. The key advantage is that it enables the organization to build use cases incrementally and expand scope in a controlled way, resulting in more complex and meaningful detections over time. By validating one high-value use case first (unauthorized access to production control systems), the team learns what telemetry is reliable, what fields are available, and what tuning is needed to reduce false positives. That validated foundation supports expanding into broader and more complex scenarios such as supply chain disruptions and malware detection, which typically require correlation across multiple data sources and longer time windows. Option A is incorrect because output-driven deployments may still require logs from non-critical systems if they contribute to a use case. Option B describes an enforcement capability (more SOAR/controls) and is not inherent to SIEM. Option D is unrealistic; even with strong use cases, real-time response depends on staffing, playbooks, and control execution. Therefore, the strongest advantage described in the options is the ability to build and expand toward more complex use cases with increasing scope and maturity.