mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A large enterprise with a centralized Security…
A large enterprise with a centralized Security Information and Event Management (SIEM) system is experiencing a high volume of false positive alerts. The security team is overwhelmed and has started to ignore many alerts. During a recent incident, a critical alert indicating lateral movement by an attacker was missed because it was buried among hundreds of false positives. The incident escalated significantly before it was discovered. The CISO has asked the incident response manager to recommend improvements to prevent this from happening again. What should the manager recommend as the primary action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune SIEM rules to eliminate known false positives
Tuning the SIEM rules to reduce false positives is the most direct way to improve alert quality without losing coverage. Increasing thresholds may cause missed real alerts. Hiring more staff is a longer-term solution. Disabling non-critical alerts could remove important detection capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase all alert thresholds to reduce volume
Why it's wrong here
Raising thresholds may cause genuine incidents to be missed.
- ✓
Tune SIEM rules to eliminate known false positives
Why this is correct
Fine-tuning rules reduces noise while maintaining detection of true positives.
- ✗
Hire additional security analysts to handle the load
Why it's wrong here
While helpful, this does not address the root cause of false positives and is not immediate.
- ✗
Disable all non-critical alert categories
Why it's wrong here
Disabling categories may remove detection of important but less frequent threats.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.