hardMultiple ChoiceObjective-mapped
200-201 Practice Question: A SOC team is evaluating a SIEM rule that…
A SOC team is evaluating a SIEM rule that triggers on 'more than 10 failed login attempts from a single source within 5 minutes.' The rule is generating too many alerts from a legitimate external monitoring service. How should the rule be modified?
⚠ Common exam trap
Cisco often tests the concept that tuning a SIEM rule should preserve detection capability for actual threats, so candidates mistakenly choose threshold or time-window adjustments (A or D) instead of the more precise fix of adding an exception for the known benign source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add an exception for the source IP of the monitoring service.
The rule is generating false positives from a known, legitimate source. Adding an exception for the monitoring service's source IP allows the SIEM to continue detecting actual brute-force attacks while ignoring expected traffic from that specific host. This is a standard whitelisting technique in SIEM rule tuning to reduce noise without compromising security coverage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the threshold to 20 failed attempts.
Why it's wrong here
This may allow attackers to try more before alerting.
- ✗
Disable the rule and rely on other detection methods.
Why it's wrong here
Removing the rule weakens security.
- ✓
Add an exception for the source IP of the monitoring service.
Why this is correct
Exceptions effectively reduce false positives without changing rule logic.
- ✗
Extend the time window to 10 minutes.
Why it's wrong here
Longer window may include more legitimate attempts, not fewer.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.