mediumMultiple ChoiceObjective-mapped
How Do You Reduce False Positives in a SIEM Correlation Rule for Failed Logins?
A security analyst observes repeated failed login attempts to an internal web server from multiple external IP addresses. The analyst creates a correlation rule that triggers an alert if more than 10 failed logins occur from a single source IP within 5 minutes. After deploying the rule, the analyst finds that the rule generates false positives from legitimate users who mistype passwords. Which action should the analyst take to reduce false positives while maintaining detection effectiveness?
Quick Answer
The correct action is to increase the threshold to 15 failed logins within a 10-minute window. This adjustment reduces false positives in SIEM correlation rules by raising the tolerance for legitimate user errors—such as mistyped passwords—while still capturing brute-force attacks that generate a higher volume of failures over a sustained period. On the Cisco CyberOps Associate 200-201 exam, this scenario tests your ability to tune correlation rules for balancing sensitivity and specificity, a key skill for security monitoring. A common trap is to lower the threshold or shorten the window, which would increase false positives, or to ignore the time window entirely. Remember the memory tip: “Raise the bar, widen the view” — increase both the count and the time window to filter out noise without missing real threats.
⚠ Common exam trap
Cisco often tests the misconception that reducing the time window or lowering the threshold improves detection, when in fact it increases false positives, and that whitelisting or blocking IPs is a proper tuning action rather than adjusting the rule's parameters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the threshold to 15 failed logins within a 10-minute window.
Increasing the threshold to 15 failed logins within a 10-minute window reduces false positives by allowing more mistyped attempts from legitimate users before triggering an alert, while still detecting brute-force attacks. The longer time window and higher threshold smooth out transient user errors without significantly delaying detection of sustained attack patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Whitelist all external IP addresses that belong to business partners.
Why it's wrong here
Whitelisting external IPs could exclude malicious IPs and reduce visibility.
- ✗
Reduce the time window to 2 minutes to catch attacks faster.
Why it's wrong here
Reducing the window would increase false positives as legitimate mistypes might occur within 2 minutes.
- ✗
Change the rule to block the source IP after 5 failed attempts.
Why it's wrong here
Blocking after 5 failures would still trigger on legitimate mistypes and may block users.
- ✓
Increase the threshold to 15 failed logins within a 10-minute window.
Why this is correct
Higher threshold and longer window reduce false positives from occasional mistypes while still detecting sustained attacks.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst notices repeated failed login attempts to a critical server from a single external IP address over the past 30 minutes. The SIEM has a correlation rule that triggers an alert when the threshold of 10 failed attempts in 5 minutes is exceeded. However, no alert was generated. What is the most likely cause?
medium- A.The SIEM is not receiving logs from the authentication server.
- ✓ B.The correlation rule uses a sliding window, and the failed attempts occurred over more than 5 minutes.
- C.The analyst is monitoring the wrong log source.
- D.The SIEM correlation rule requires a minimum of 15 failed attempts.
Why B: The SIEM correlation rule uses a sliding window that triggers an alert only when 10 failed attempts occur within a 5-minute window. Since the analyst observed repeated failed attempts over 30 minutes, the attempts are spread across multiple 5-minute windows, so no single window exceeds the threshold. This is a classic case where the event frequency is high overall but does not meet the rule's temporal aggregation criteria.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.