hardMultiple ChoiceObjective-mapped
How to Reduce SIEM Alert Fatigue Without Increasing Risk
An organization uses a SIEM that ingests logs from multiple sources. The analysts are overwhelmed with alerts, many of which are false positives. Which strategy best reduces alert fatigue without increasing risk?
Quick Answer
The answer is to fine-tune correlation rules and thresholds based on historical data. This strategy directly reduces SIEM alert fatigue by aligning detection logic with the organization’s normal baseline, filtering out false positives while preserving the ability to detect genuine threats. On the Cisco CyberOps Associate 200-201 exam, this concept tests your understanding of tuning as a risk-aware process—unlike disabling rules or adding staff, which fail to address poor alert quality. A common trap is assuming more alerts mean better security; instead, the exam emphasizes that quality over quantity reduces fatigue without increasing risk. Memory tip: think “Tune, don’t mute”—fine-tuning retains coverage, while muting rules creates blind spots.
⚠ Common exam trap
Cisco often tests the misconception that reducing alerts means disabling rules or adding more staff, when the correct approach is to refine detection logic through tuning and baselining to maintain security coverage while minimizing noise.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Fine-tune correlation rules and thresholds based on historical data.
Fine-tuning correlation rules and thresholds (option D) reduces false positives by aligning detection logic with the organization's normal baseline, derived from historical data. This directly addresses alert fatigue without disabling security coverage, as it retains the SIEM's ability to detect genuine threats while filtering out noise. In contrast, simply disabling rules or adding staff fails to address the root cause of poor alert quality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a ticketing system for alerts.
Why it's wrong here
Manages alerts but does not reduce them.
- ✗
Disable all correlation rules except critical ones.
Why it's wrong here
May miss important events; too drastic.
- ✗
Increase the number of analysts on shift.
Why it's wrong here
Does not reduce alert volume; just adds manpower.
- ✓
Fine-tune correlation rules and thresholds based on historical data.
Why this is correct
Reduces false positives while retaining detection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A SOC team is evaluating a SIEM rule that triggers on 'more than 10 failed login attempts from a single source within 5 minutes.' The rule is generating too many alerts from a legitimate external monitoring service. How should the rule be modified?
hard- A.Increase the threshold to 20 failed attempts.
- B.Disable the rule and rely on other detection methods.
- ✓ C.Add an exception for the source IP of the monitoring service.
- D.Extend the time window to 10 minutes.
Why C: The rule is generating false positives from a known, legitimate source. Adding an exception for the monitoring service's source IP allows the SIEM to continue detecting actual brute-force attacks while ignoring expected traffic from that specific host. This is a standard whitelisting technique in SIEM rule tuning to reduce noise without compromising security coverage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.