hardMultiple Choice
ISC2 CC Practice Question: A large organization has implemented a Security…
A large organization has implemented a Security Operations Center (SOC) with a tiered incident response model. Tier 1 analysts triage alerts and escalate confirmed incidents to Tier 2 for deeper analysis. Recently, the SOC has been overwhelmed by a high volume of low-severity alerts from endpoint detection and response (EDR) tools, causing delays in handling true positive incidents. The SOC manager wants to reduce alert fatigue without missing critical threats. Which of the following strategies would be MOST effective?
⚠ Common exam trap
The trap here is the instinct to either throw more people at the problem or silence noisy rules; the exam expects you to recognize that automation of triage, not headcount or rule suppression, is the scalable fix for alert fatigue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement automated playbooks for low-severity alerts to perform initial investigation and closure if benign.
Automated playbooks (SOAR-style) let the SOC enrich, correlate, and close low-severity alerts without human intervention, freeing Tier 1 and Tier 2 analysts to focus on genuine threats. This directly reduces alert fatigue while preserving detection coverage, because the rules remain enabled and only the triage step is automated. It is the only option that scales without degrading detection or analyst workload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require Tier 2 analysts to review all alerts before Tier 1.
Why it's wrong here
Requiring Tier 2 to review all alerts inverts the tiered escalation model, so senior analysts absorb the same low-severity EDR volume that already overwhelms Tier 1, delaying true positives further. It is tempting because Tier 2 expertise suits deep analysis, but that applies after triage filters and enriches alerts, not as a first-pass queue.
- ✗
Increase the number of Tier 1 analysts to handle the volume.
Why it's wrong here
Adding Tier 1 analysts scales triage capacity but leaves the EDR detection rules generating the same low-severity volume, so true positives still queue behind noise. It is tempting because headcount genuinely helps when alert volume is legitimate and sustained, such as during a merger or after onboarding many new endpoints.
- ✓
Implement automated playbooks for low-severity alerts to perform initial investigation and closure if benign.
Why this is correct
Automated playbooks let Tier 1 offload repetitive low-severity triage, performing initial investigation and closing benign alerts without human effort. This preserves analyst capacity for genuine threats, directly reducing alert fatigue while maintaining detection of true positives.
- ✗
Disable all low-severity alert rules in the EDR.
Why it's wrong here
Disabling low-severity rules outright suppresses the telemetry those detections rely on, so genuine threats that first surface as low-severity anomalies are never triaged. It is tempting because rule tuning is a recognised way to cut noise, but the correct approach is risk-based filtering or correlation, not wholesale removal of detection coverage.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Incident response
Incident response is the structured approach an organization uses to identify, contain, and recover from cybersecurity incidents like data breaches or ransomware attacks.
Key term
Security operations center
A Security Operations Center (SOC) is a centralized team and facility that monitors, detects, analyzes, and responds to cybersecurity incidents across an organization's IT environment 24/7.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.