A SOC manager is reviewing the alert rules in their SIEM. Currently, there is an alert that fires whenever any user accesses a sensitive file share. This generates hundreds of alerts per day, most of which are legitimate business activity. What is the best way to make this alert more actionable?

Delete the alert rule because it is not useful

Keep the alert as is and have analysts manually triage all alerts

Increase the severity of the alert to ensure it gets immediate attention

Refine the alert to trigger only when access occurs outside of business hours or from a non-standard device

What is a baseline of network traffic?

A snapshot of the network at a single point in time

A list of all known malicious IP addresses

A configuration file for network devices

A set of expected traffic patterns under normal operating conditions

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 10)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 46–47

46application · medium
A SOC manager is reviewing the alert rules in their SIEM. Currently, there is an alert that fires whenever any user accesses a sensitive file share. This generates hundreds of alerts per day, most of which are legitimate business activity. What is the best way to make this alert more actionable?
Select an answer first
47foundation · easy
What is a baseline of network traffic?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 10)

Questions 46–47

A SOC manager is reviewing the alert rules in their SIEM. Currently, there is an alert that fires whenever any user accesses a sensitive file share. This generates hundreds of alerts per day, most of which are legitimate business activity. What is the best way to make this alert more actionable?

What is a baseline of network traffic?

Keep studying — Security Operations