Security Monitoring →mediumMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

A SOC analyst is tuning IDS signatures and notices that a particular signature triggers frequently on legitimate traffic from a specific internal application. The signature has a high false positive rate. What is the best action to take?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a suppression rule to ignore the specific source IP or application.

To reduce false positives without losing detection capability, the analyst should create a suppression filter that excludes the known benign IP or application from triggering the signature.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disable the signature entirely.
Why it's wrong here
Disabling may leave the network exposed to real attacks matching that signature.
✗
Increase the severity of the signature to get more attention.
Why it's wrong here
This would worsen the false positive problem, not solve it.
✓
Create a suppression rule to ignore the specific source IP or application.
Why this is correct
A suppression rule allows the signature to remain active but not alert on known benign traffic.
✗
Change the signature action to 'alert' instead of 'drop'.
Why it's wrong here
This does not address the false positive rate; it just changes the action.

Visual reference

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question