mediumMultiple ChoiceObjective-mapped
CRISC Practice Question: Deployed a new intrusion detection system (IDS)…
An organization deployed a new intrusion detection system (IDS) that generates many alerts. The security team is overwhelmed and has started ignoring some alerts. What is the BEST way to address this issue?
⚠ Common exam trap
Test-takers frequently choose 'Implement a SIEM' (Option A) thinking it solves alert overload, but CRISC emphasizes that monitoring tools must first be properly configured before layering additional technology, and tuning the source system is the most direct and cost-effective control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune the IDS to reduce false positive alerts.
Tuning the IDS to reduce false positive alerts directly addresses the root cause of alert fatigue: excessive noise from misconfigured or overly sensitive detection rules. By adjusting thresholds, signatures, and exclusion lists, the security team can focus on genuine threats without being overwhelmed, which is a core risk monitoring and reporting practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a SIEM to filter and prioritize alerts.
Why it's wrong here
SIEM helps but tuning is still needed.
- ✗
Deactivate the IDS until it can be properly configured.
Why it's wrong here
Deactivating removes monitoring capability.
- ✓
Tune the IDS to reduce false positive alerts.
Why this is correct
Reducing false positives improves efficiency.
- ✗
Hire additional security analysts to handle the alert volume.
Why it's wrong here
Adding headcount does not address the root cause of alert fatigue—the IDS’s poor signal-to-noise ratio due to misconfigured detection rules. The correct approach is tuning the IDS to reduce false positives, which hiring cannot achieve. This option is tempting because additional analysts can manage high volumes in a properly tuned system, where alerts are predominantly genuine and require triage.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.