hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A company uses a SIEM that collects logs from…
A company uses a SIEM that collects logs from firewalls, servers, and endpoints. The SIEM is generating a high volume of low-priority events, causing analysts to miss critical alerts. Which approach would best improve the signal-to-noise ratio?
⚠ Common exam trap
Cisco often tests the misconception that 'more data equals better security' (Option B), but the real goal is to reduce noise through intelligent filtering and correlation, not to increase data volume.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement event filtering and correlation rules to reduce false positives.
The SIEM's high volume of low-priority events indicates a poor signal-to-noise ratio, where benign or irrelevant events drown out critical alerts. Implementing event filtering and correlation rules directly reduces false positives by discarding known noise (e.g., repeated benign scans) and grouping related events into meaningful alerts, allowing analysts to focus on genuine threats. This is the standard approach in SIEM tuning to improve detection fidelity without adding resources or data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement event filtering and correlation rules to reduce false positives.
Why this is correct
Filtering and correlation reduce noise and highlight relevant events.
- ✗
Deploy additional sensors to collect more data.
Why it's wrong here
More data may increase noise unless properly filtered.
- ✗
Hire more analysts to review all events.
Why it's wrong here
Hiring does not reduce noise; it only adds manpower to handle the volume.
- ✗
Increase the storage capacity of the SIEM.
Why it's wrong here
More storage does not reduce noise; it only accommodates more events.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.