SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable all logging for the backup server.

  Why it's wrong here

  Disabling all logging on the backup server is an irreversible, overbroad response that strips the SIEM of forensic visibility into a sensitive, high-value asset. Backups often contain credentials or business-critical data, so malicious actions against that server would become completely untraceable, undermining compliance and incident response. Alert fatigue should be managed by tuning detection logic, not by severing the data source that feeds it.

• ✓

  Tune the rule to exclude the known backup activity pattern.

  Why this is correct

  Alert tuning should reduce false positives without losing useful detection. If the backup job is documented and legitimate, the analyst can adjust the rule to exclude that approved activity pattern or server. This keeps the SIEM useful and helps responders focus on real suspicious behavior instead of repeated harmless alerts.

• ✗

  Ignore the alerts permanently because the job is approved.

  Why it's wrong here

  Approval of the backup job does not make the alert pattern benign, because attackers often seek to blend in with legitimate administrative or maintenance workflows. Silently ignoring the alerts desensitizes analysts and wastes SIEM processing time, while also preventing the team from noticing when backup behavior subtly changes to something malicious. The correct response is to refine the rule's pattern or threshold so that routine activity is excluded without suppressing genuine anomalies.

• ✗

  Reimage the backup server to stop the alerts.

  Why it's wrong here

  Reimaging the backup server assumes a compromise or OS fault that is not supported by the alert details — this scenario describes a rule generation problem, not a host integrity failure. A rebuild would interrupt backup schedules, risk data loss, and waste hours of administrative effort, then likely regenerate the same alerts if the rule is still misconfigured. The prudent step is to modify the SIEM rule's logic to recognize the scheduled backup as a known-good pattern.