Questão 60 — CompTIA SY0-701 CompTIA Security+ Certification Exam
A security operations team is implementing a new Security Information and Event Management (SIEM) system to consolidate logs from multiple sources across the enterprise. During configuration, the team must decide how to handle the large volume of events being ingested daily. They identify that approximately 60% of the events are routine system activities that rarely indicate security concerns, while 40% have historically been associated with actual security incidents. The team is concerned about alert fatigue degrading the efficiency of incident response. Which of the following approaches BEST addresses this concern while maintaining effective threat detection?
- A. Configure the SIEM to ignore all routine system activities and only alert on the 40% of events historically associated with incidents
- B. Implement tuning and filtering to baseline normal activities, then configure correlation rules that generate alerts only when deviation from baseline is detected or when specific indicators of compromise are present
- C. Set the SIEM to alert on all events with equal priority and require security analysts to manually evaluate every alert during their shift
- D. Configure the SIEM to suppress all alerts during business hours when IT staff can explain routine activities, and only send alerts during off-hours when activity is more suspicious
Resposta correta:
B
Explicação
Explanation: Correct answer: B. Implement tuning and filtering to baseline normal activities, then configure correlation rules that generate alerts only when deviation from baseline is detected or when specific indicators of compromise
Quer todas as 907 questões por R$ 1,00?