hardMultiple SelectObjective-mapped
200-201 Practice Question: Which TWO are best practices for managing SIEM…
Which TWO are best practices for managing SIEM alerts to reduce false positives? (Choose two.)
⚠ Common exam trap
Cisco often tests the misconception that more data (Option D) or volume-based suppression (Option A) is a valid way to reduce false positives, when in fact proper tuning and whitelisting are the correct approaches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regularly tune correlation rules based on feedback.
SIEM correlation rules must be regularly tuned based on feedback from incident investigations and alert reviews. This iterative process adjusts thresholds, filters, and logic to match the actual threat landscape, reducing noise from benign events that match rule patterns but are not malicious.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable all alerts that generate more than 100 events per day.
Why it's wrong here
May miss true positives.
- ✗
Use a separate SIEM for each department.
Why it's wrong here
Splits visibility, not reduce false positives.
- ✓
Regularly tune correlation rules based on feedback.
Why this is correct
Adapts to environment.
- ✗
Increase the number of log sources.
Why it's wrong here
May increase noise.
- ✓
Maintain a whitelist of known benign activity.
Why this is correct
Filters out known good.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.