CISM Question 365

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  D. High number of false positives A high number of false positives can overwhelm security teams with a large volume of alerts that are not actual security threats, leading to alert fatigue. This can result in important security incidents being missed or ignored because they are buried among a sea of false alarms. False positives can also waste valuable time and resources investigating non-issues, reducing the efficiency of security operations. Therefore, managing and minimizing false positives is a critical aspect of effectively using a SIEM system.

• Chose B1

  B AIO Chapter 2 "Lack of/deficient SIEM: A security information and event management (SIEM) is a system that collects log data from servers, endpoints, network devices such as firewalls, and other sources such as antivirus consoles. It correlates this log data and produces security alerts when actionable security-related activities are taking place. An organization without a SIEM may have little way of knowing whether security incidents such as break-ins are occurring. Similarly, an organization with a SIEM that is not well maintained may also have many blind spots and may be unaware of incidents occurring in its environment."

• 1

  D. High number of false positives. An automated SIEM tool will be missing the human analysis and logical judgment to distinguish between what is a legitimate event versus a false one. A significant number of False positives will be what to expect in this scenario.