6.2 Identify Methods to Optimize Security Operations Center (SOC) Performance (e.g., Automation and AI, Collaboration and Information Sharing, Regular Security Policy Updates, Security Framework Alignment) CYBERSECURITY-APPRENTICE Practice Questions (Page 6)

Questions 26–26

1. 26application · medium

   A SOC team is overwhelmed by a high volume of low-fidelity alerts, causing analysts to suffer from alert fatigue. The team wants to improve detection accuracy while reducing false positives. Which combination of actions would be most effective?

   • AUse machine learning to baseline normal network behavior and tune alert rules to reduce noise.
   • BRequire analysts to manually review every alert to determine if it is a false positive.
   • CIncrease the severity of all alerts so analysts pay more attention to them.
   • DDisable all alerts that have not triggered in the past month.
   Reveal Solution Discussion Select an answer first