350-201 Question 122
Select 3An organization has implemented Cisco Secure Firewall and Cisco Secure Endpoint to protect its network and endpoints. However, the security team is noticing an excessive number of false-positive alerts, which is impacting their ability to respond to real threats. Which of the following actions should be taken to tune the devices and software effectively?
- A
Modify detection rule thresholds based on observed network behavior.
- B
Disable all rules to prevent unnecessary alerts and reduce noise.
- C
Analyze historical alert data to identify patterns and optimize filters.
- D
Implement dynamic filtering to automatically block all traffic from unknown sources.
- E
Update policies to align with specific organizational risk tolerance and compliance requirements.
Show answer and explanation
Correct answers: A, C, E
Explanation
To effectively tune devices and software, the security team should focus on improving the accuracy of detection rules and filters by analyzing network behavior and historical data. Additionally, updating policies to align with the organization's specific needs ensures that security tools operate effectively without generating excessive false positives.
- A. Correct.
Correct: Modifying detection rule thresholds can help reduce false positives by aligning the settings with the organization's specific network behavior.
- B. Incorrect.
Incorrect: Disabling all rules would expose the network to significant threats and is not a recommended approach.
- C. Correct.
Correct: Analyzing historical alert data is crucial for identifying patterns and fine-tuning filters to reduce unnecessary alerts.
- D. Incorrect.
Incorrect: Blocking all traffic from unknown sources could disrupt legitimate communication and is not a practical solution for tuning devices.
- E. Correct.
Correct: Updating policies to reflect the organization's risk tolerance ensures that rules and filters are relevant and effective.