Security Monitoring →hardMultiple SelectObjective-mapped

200-201 Security Monitoring Practice Question

A SOC analyst is reviewing a large number of alerts from a SIEM. Which THREE of the following are effective steps to prioritize and investigate alerts in a high-volume environment? (Choose three.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Prioritize alerts based on severity and asset criticality.

Prioritizing by severity, correlating with threat intelligence, and checking for associated IoCs help focus on important alerts. Alert fatigue leads to missed incidents; automation and triage are key.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Investigate alerts in the order they were received.
Why it's wrong here
This is inefficient; priority should be based on risk, not chronological order.
✓
Prioritize alerts based on severity and asset criticality.
Why this is correct
High-severity alerts on critical assets should be investigated first.
✓
Correlate alerts with known threat intelligence feeds to identify true positives.
Why this is correct
Threat intel helps validate whether an alert matches known malicious activity.
✗
Automatically close all low-severity alerts without review.
Why it's wrong here
Low-severity alerts can still indicate lateral movement or recon; they should be reviewed periodically.
✓
Group alerts by source IP to identify patterns like brute force or port scans.
Why this is correct
Aggregating by source IP can reveal coordinated attacks from a single host.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question