CS0-003 Security Operations Practice Question
A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exclude failed logins from known service accounts
Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exclude failed logins from known service accounts
Why this is correct
Service accounts frequently generate legitimate failed-login noise from scheduled password rotations, expired credentials in automation scripts, or misconfigured connection strings, none of which represent an attacker probing for access. Suppressing these known, expected sources removes a large share of benign alert volume without weakening detection against genuine unauthorized login attempts from unexpected accounts or sources.
- ✗
Disable the rule entirely
Why it's wrong here
Disabling the rule entirely eliminates the alert noise problem by also eliminating all detection capability, including for real brute-force attacks — the opposite of the stated goal, which is to reduce false positives while still catching genuine attacks. A rule that never fires isn't tuned, it's removed, taking away the SIEM's ability to flag credential-stuffing or password-spraying activity entirely.
- ✗
Increase the alert severity to critical for all failed logins
Why it's wrong here
Raising every failed-login alert to critical severity changes how alerts are prioritized in the queue but does nothing to reduce the actual number of alerts being generated — the SIEM still fires on every single failure, so the analyst team remains overwhelmed by volume. It may even worsen things by burying genuinely urgent alerts among a flood of newly-critical low-value ones.
- ✗
Add a correlation rule to trigger on successful login after multiple failures
Why it's wrong here
A correlation rule for a successful login after multiple failures is a genuinely useful detection for catching brute-force attempts that ultimately succeed, but it's an additional detection layer, not a noise-reduction technique — it doesn't touch the volume of individual failed-login alerts already overwhelming the team, so on its own it doesn't solve the stated tuning problem.
- ✓
Require a minimum threshold of 5 failed attempts from the same source IP within 10 minutes before alerting
Why this is correct
Setting a threshold of multiple failures from the same source within a short window filters out the high-volume background noise of isolated typos, expired passwords, and one-off misclicks, since those rarely repeat five times from one IP in ten minutes. Genuine brute-force or password-spraying activity is characterized by exactly this kind of repeated rapid-fire failure pattern, so the threshold preserves detection of real attacks while suppressing the vast majority of harmless noise.
Go deeper
Related to this question
Learn chapter
SIEM Log Analysis
Key term
Detection
Detection is the process of identifying potential security incidents or anomalies by analyzing system data, logs, and network traffic.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.