mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A government contractor is required to comply…
A government contractor is required to comply with the Federal Information Security Management Act (FISMA). The security officer must implement a continuous monitoring program for all information systems. The contractor uses a mix of on-premises servers and cloud services. The contractor has a SIEM tool that collects logs from all systems. However, the SIEM generates a high number of alerts, many of which are false positives, overwhelming the security team. The team wants to improve the effectiveness of the monitoring program without increasing staff. Which of the following actions would MOST effectively address the issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tune the SIEM correlation rules and create custom filters to reduce false positive alerts
Tuning the SIEM correlation rules and creating custom filters directly reduces false positives, making alerts more actionable and allowing the team to focus on real incidents without adding staff. Option A (disabling low-severity alerts) is too blunt and may miss important events. Option B (hiring analysts) is costly and doesn't address the root cause. Option C (increasing log collection frequency) would generate even more alerts, worsening the problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable alerts for low-severity events
Why it's wrong here
This may miss real threats; tuning is more intelligent.
- ✗
Hire additional security analysts to review all alerts
Why it's wrong here
Hiring increases cost and does not leverage existing tools.
- ✗
Increase the frequency of log collection to every minute
Why it's wrong here
More frequent collection may generate even more alerts without addressing quality.
- ✓
Tune the SIEM correlation rules and create custom filters to reduce false positive alerts
Why this is correct
This directly reduces alert fatigue and improves efficiency.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.