A large e-commerce company has a SIEM that generates 10,000 alerts per day, and the security operations team of five analysts is overwhelmed. After a review, the team finds that 80% of alerts are false positives from a legacy application that generates unusual but benign network traffic. The team has limited time to tune rules and must reduce the alert volume quickly without missing a real attack. What is the most effective immediate action?

Suppress alerts from the legacy application's source IP addresses for 30 days while investigating the application's behavior.

Disable the correlation rules that are generating the false positives and review them one by one.

Add more analysts to the team to manually review all 10,000 alerts.

Increase the severity threshold for all alerts so only critical alerts are displayed.

What is the primary benefit of integrating threat intelligence feeds into a SIEM?

To replace the need for log analysis

To automatically patch vulnerabilities

To enrich alerts with indicators of compromise

Which of the following is a common use case for UEBA?

Monitoring privileged user activity

Encrypting email communications

Patching software vulnerabilities

Certified Information Systems Security Professional

Domain 7Objective 2

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 7)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

13%of the exam

Questions 31–35

31foundation · easy
Which step is typically the first in the threat hunting process?
Select an answer first
32expert · hard
A large e-commerce company has a SIEM that generates 10,000 alerts per day, and the security operations team of five analysts is overwhelmed. After a review, the team finds that 80% of alerts are false positives from a legacy application that generates unusual but benign network traffic. The team has limited time to tune rules and must reduce the alert volume quickly without missing a real attack. What is the most effective immediate action?
Select an answer first
33foundation · easy
What is the primary benefit of integrating threat intelligence feeds into a SIEM?
Select an answer first
34foundation · easy
Which of the following is a common use case for UEBA?
Select an answer first
35foundation · easy
Which phase of the log management lifecycle involves ensuring that logs are stored securely and are not tampered with?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 7)

Questions 31–35

Which step is typically the first in the threat hunting process?

What is the primary benefit of integrating threat intelligence feeds into a SIEM?

Which of the following is a common use case for UEBA?

Which phase of the log management lifecycle involves ensuring that logs are stored securely and are not tampered with?

Keep studying — Security Operations