200-201 Question 113

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  C - false positives and false negatives often result from poorly defined or outdated signature rules in intrusion detection systems (IDS). Redefining or tuning these signature rules helps reduce false positives (legitimate actions being flagged) and false negatives (malicious activity going unnoticed), improving the efficiency of the alert system.

• 3

  Correct Answer is A

• Chose B1

  The correct answer is B. Design criteria for reviewing alerts. When a system is overwhelmed with alerts, indicating a high number of both false positives (incorrectly identifying benign events as threats) and false negatives (failing to detect actual threats), it is important to establish criteria for reviewing alerts. This allows for a more efficient and effective handling of the alerts and helps prioritize the investigation of genuine security incidents. Designing criteria for reviewing alerts involves creating rules or thresholds that filter and prioritize alerts based on their severity, likelihood of being true positives, or other relevant factors. By setting criteria, analysts can focus their efforts on alerts that have a higher probability of being legitimate threats, reducing the time and resources wasted on false positives and irrelevant alerts.