mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is configuring a SIEM and wants to reduce false…
A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?
⚠ Common exam trap
A common mix-up: candidates confuse network security controls (like blocking IPs) with SIEM tuning techniques, or assume that default rules or aggregation alone can achieve optimal detection without contextual customization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.
Tuning correlation rules to the organization's specific asset inventory, network architecture, and threat intelligence directly reduces false positives by filtering out irrelevant events while ensuring that real attacks against known assets are detected. This approach leverages contextual knowledge to adjust thresholds, exclude noise, and prioritize alerts that match the actual attack surface, achieving the desired balance between sensitivity and specificity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Aggregate all logs from all sources and create a single correlation rule for each attack type.
Why it's wrong here
This approach would likely generate many false positives due to lack of specificity and context.
- ✗
Use the default correlation rules provided by the SIEM vendor without modification.
Why it's wrong here
Default rules may not fit the organization's environment, leading to high false positive rates.
- ✗
Block all traffic from external IP addresses that are not on the organization's whitelist.
Why it's wrong here
This is a firewall action, not a SIEM configuration, and would disrupt legitimate traffic.
- ✓
Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.
Why this is correct
Custom tuning ensures rules are relevant and accurate, reducing false positives while detecting true threats.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.