mediumMultiple Choice
SSCP Practice Question: A government contractor is required to comply…
A government contractor is required to comply with the Federal Information Security Management Act (FISMA). The security officer must implement a continuous monitoring program for all information systems. The contractor uses a mix of on-premises servers and cloud services. The contractor has a SIEM tool that collects logs from all systems. However, the SIEM generates a high number of alerts, many of which are false positives, overwhelming the security team. The team wants to improve the effectiveness of the monitoring program without increasing staff. Which of the following actions would MOST effectively address the issue?
⚠ Common exam trap
SSCP often tests the misconception that simply suppressing alerts or adding staff solves alert fatigue, when the most effective solution is to refine the detection logic itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune the SIEM correlation rules and create custom filters to reduce false positive alerts
Tuning SIEM correlation rules and creating custom filters directly addresses the root cause of false positives by refining detection logic to match the contractor's specific environment and threat profile. This reduces alert noise without discarding potentially valuable low-severity data or requiring additional staff. It aligns with FISMA continuous monitoring requirements by improving the signal-to-noise ratio, enabling the existing team to focus on genuine threats. This is the most effective and sustainable solution because it enhances the tool's accuracy rather than just suppressing or adding resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable alerts for low-severity events
Why it's wrong here
Disabling low-severity alerts suppresses genuine indicators alongside false positives, weakening FISMA continuous monitoring and leaving blind spots. Severity filtering is tempting because it reduces volume cheaply, and would suit a tuned environment where low-severity events are confirmed non-actionable noise.
- ✗
Hire additional security analysts to review all alerts
Why it's wrong here
Hiring analysts increases headcount, directly contradicting the stem's requirement to improve monitoring without adding staff. Adding personnel is tempting because it addresses alert volume, and would be the right answer if the constraint were budget rather than staffing.
- ✗
Increase the frequency of log collection to every minute
Why it's wrong here
Collecting logs every minute increases event volume and therefore alert count, worsening the false-positive flood rather than reducing it. Higher collection frequency suits environments needing finer-grained detection fidelity, not one already overwhelmed by alert volume.
- ✓
Tune the SIEM correlation rules and create custom filters to reduce false positive alerts
Why this is correct
Tuning correlation rules and building custom filters directly targets the false-positive volume that overwhelms the team, satisfying the constraint of improving monitoring effectiveness without adding staff. By refining detection logic against the contractor's actual baseline across on-premises and cloud sources, genuine FISMA-relevant events surface, restoring continuous monitoring capability.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.