hardMultiple Choice
How to Reduce SIEM Alert Fatigue Without Increasing Risk
An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?
Quick Answer
The answer is to fine-tune correlation rules and thresholds based on historical data. This strategy directly reduces SIEM alert fatigue by aligning detection logic with the organization’s normal baseline, filtering out false positives while preserving the ability to detect genuine threats. On the Cisco CyberOps Associate 200-201 exam, this concept tests your understanding of tuning as a risk-aware process—unlike disabling rules or adding staff, which fail to address poor alert quality. A common trap is assuming more alerts mean better security; instead, the exam emphasizes that quality over quantity reduces fatigue without increasing risk. Memory tip: think “Tune, don’t mute”—fine-tuning retains coverage, while muting rules creates blind spots.
⚠ Common exam trap
Cisco often tests the misconception that reducing alerts means disabling rules or adding more staff, when the correct approach is to refine detection logic through tuning and baselining to maintain security coverage while minimizing noise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fine-tune correlation rules and thresholds based on historical data.
Fine-tuning correlation rules and thresholds (option D) reduces false positives by aligning detection logic with the organization's normal baseline, derived from historical data. This directly addresses alert fatigue without disabling security coverage, as it retains the SIEM's ability to detect genuine threats while filtering out noise. In contrast, simply disabling rules or adding staff fails to address the root cause of poor alert quality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a ticketing system for alerts.
Why it's wrong here
A ticketing system records and tracks alerts but does not filter or suppress false positives, so analysts still face the same alert volume. Ticketing is correct when the requirement is auditability, assignment and SLA tracking of confirmed incidents rather than reducing the raw alert stream.
- ✗
Disable all correlation rules except critical ones.
Why it's wrong here
Disabling correlation rules wholesale removes detection coverage, so genuine threats that those rules would have surfaced go unnoticed — increasing risk. Selective tuning of noisy rules preserves coverage. Disabling is appropriate only for rules proven redundant or superseded by equivalent detections elsewhere.
- ✗
Increase the number of analysts on shift.
Why it's wrong here
Adding analysts increases human capacity to triage the same volume of false positives; it does not reduce the number of alerts generated, so fatigue persists and cost rises. Staffing is the right answer when alert volume is genuinely matched to headcount, not when tuning is required to suppress noise at source.
- ✓
Fine-tune correlation rules and thresholds based on historical data.
Why this is correct
Fine-tuning correlation rules and thresholds against historical data suppresses the noisy signatures generating false positives while preserving detection logic for genuine threats, directly reducing alert volume. Unlike disabling rules or widening exclusions, this adjusts sensitivity without creating blind spots, satisfying the requirement to cut fatigue without increasing risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC team is evaluating a SIEM rule that triggers on 'more than 10 failed login attempts from a single source within 5 minutes.' The rule is generating too many alerts from a legitimate external monitoring service. How should the rule be modified?
hard- A.Increase the threshold to 20 failed attempts.
- B.Disable the rule and rely on other detection methods.
- ✓ C.Add an exception for the source IP of the monitoring service.
- D.Extend the time window to 10 minutes.
Why C: The rule is generating false positives from a known, legitimate source. Adding an exception for the monitoring service's source IP allows the SIEM to continue detecting actual brute-force attacks while ignoring expected traffic from that specific host. This is a standard whitelisting technique in SIEM rule tuning to reduce noise without compromising security coverage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.