The correct action is to increase the threshold to 15 failed logins within a 10-minute window. This adjustment reduces false positives in SIEM correlation rules by raising the tolerance for legitimate user errors—such as mistyped passwords—while still capturing brute-force attacks that generate a higher volume of failures over a sustained period. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to tune correlation rules for balancing sensitivity and specificity, a key skill for security monitoring. A common trap is to lower the threshold or shorten the window, which would increase false positives, or to ignore the time window entirely. Remember the memory tip: “Raise the bar, widen the view” — increase both the count and the time window to filter out noise without missing real threats.
200-201 Security Monitoring Practice Question
This 200-201 practice question tests your understanding of security monitoring. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security analyst observes repeated failed login attempts to an internal web server from multiple external IP addresses. The analyst creates a correlation rule that triggers an alert if more than 10 failed logins occur from a single source IP within 5 minutes. After deploying the rule, the analyst finds that the rule generates false positives from legitimate users who mistype passwords. Which action should the analyst take to reduce false positives while maintaining detection effectiveness?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the threshold to 15 failed logins within a 10-minute window.
Option D is correct because increasing the threshold to 15 failed logins within a 10-minute window reduces false positives by allowing more mistyped attempts from legitimate users before triggering an alert, while still detecting brute-force attacks. The longer time window and higher threshold smooth out transient user errors without significantly delaying detection of sustained attack patterns.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Whitelist all external IP addresses that belong to business partners.
Why it's wrong here
Whitelisting external IPs could exclude malicious IPs and reduce visibility.
✗
Reduce the time window to 2 minutes to catch attacks faster.
Why it's wrong here
Reducing the window would increase false positives as legitimate mistypes might occur within 2 minutes.
✗
Change the rule to block the source IP after 5 failed attempts.
Why it's wrong here
Blocking after 5 failures would still trigger on legitimate mistypes and may block users.
✓
Increase the threshold to 15 failed logins within a 10-minute window.
Why this is correct
Higher threshold and longer window reduce false positives from occasional mistypes while still detecting sustained attacks.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that reducing the time window or lowering the threshold improves detection, when in fact it increases false positives, and that whitelisting or blocking IPs is a proper tuning action rather than adjusting the rule's parameters.
Detailed technical explanation
How to think about this question
Correlation rules in SIEM platforms like Splunk or Cisco Secure Analytics use sliding time windows to count events; adjusting both the threshold and window length changes the effective rate (e.g., 15/10 min = 1.5 attempts/min vs. 10/5 min = 2 attempts/min). In real-world deployments, user mistype rates often cluster around 3–5 attempts in a short burst, so a threshold of 10 within 5 minutes catches those bursts as false positives, whereas 15 within 10 minutes allows the burst to decay. This approach aligns with the principle of tuning detection thresholds based on baseline user behavior to minimize alert fatigue.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Security Monitoring — This question tests Security Monitoring — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Increase the threshold to 15 failed logins within a 10-minute window. — Option D is correct because increasing the threshold to 15 failed logins within a 10-minute window reduces false positives by allowing more mistyped attempts from legitimate users before triggering an alert, while still detecting brute-force attacks. The longer time window and higher threshold smooth out transient user errors without significantly delaying detection of sustained attack patterns.
What should I do if I get this 200-201 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?
medium
A.The SIEM is not receiving logs from the authentication server.
✓ B.The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.
C.The analyst is monitoring the wrong log source.
D.The SIEM correlation rule requires a minimum of 15 failed attempts.
Why B: Option B is correct because the SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.