Dealing with False Positive Alerts SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC team receives 500 alerts per hour. Most are low-severity false positives from a legacy IDS. A critical alert about a potential data exfiltration is buried in the queue. The team has limited staff and cannot manually review every alert. Which approach best improves the team's ability to identify the critical alert quickly?

   • AReview alerts in chronological order to ensure nothing is missed.
   • BAssign the most junior analyst to review all alerts manually.
   • CImplement a triage system that scores alerts by severity, asset criticality, and correlation with other signals.
   • DIncrease the volume of alerts by enabling more rules to catch additional threats.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC team has a limited number of analysts and a high volume of alerts. The team uses a SIEM with a risk-scoring system, but the scores are not calibrated, and many low-risk alerts are actually true positives while some high-risk alerts are false positives. The team wants to improve triage efficiency without missing genuine threats. Which approach is most effective?

   • AIncrease the alert severity for all alerts to ensure they are reviewed.
   • BAdjust the risk-scoring model based on historical false positive and true positive data, then prioritize alerts by the adjusted score.
   • CReview all alerts manually in chronological order to avoid missing anything.
   • DDisable all rules that generate false positives, regardless of their importance.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC team is overwhelmed by a high volume of false positive alerts. As a result, analysts have started ignoring alerts from a particular detection source. A genuine intrusion attempt generates an alert from that same source, but no one reviews it in time, and the attacker successfully exfiltrates data. Which concept best describes this situation?

   • AAlert fatigue caused by excessive false positives leading to missed true positives.
   • BA true negative because the alert was not acted upon.
   • CA misconfigured rule that prevented the alert from being generated.
   • DA false negative caused by the detection source failing to detect the intrusion.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A SOC team notices that a detection rule for 'suspicious PowerShell activity' generates many alerts for the IT team's legitimate automation scripts. What is the best tuning approach to reduce these false positives?

   • ACreate an exception for the specific script paths or hashes used by the IT team
   • BIncrease the alert severity so only critical alerts are shown
   • CDisable the rule entirely to stop the noise
   • DAsk the IT team to stop using PowerShell for automation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team uses a SIEM rule that alerts when a user logs in from a new geographic location. The rule generates many false positives because employees frequently travel and use VPN endpoints that appear in different locations. The team wants to reduce false positives while still detecting unusual travel patterns. Which configuration change is most effective?

   • ARemove the rule because travel-based alerts are inherently unreliable.
   • BCreate an allowlist of known VPN egress IP addresses and suppress alerts for those IPs.
   • CIncrease the alert severity to force analysts to review each alert.
   • DChange the rule to alert on every login regardless of location.
   Reveal Solution Discussion Select an answer first