350-201 Question 245
Single answerYou are tasked with automating the process of extracting and analyzing security alerts from a SIEM system to reduce manual workload. A provided Python script currently extracts raw alert data but does not filter or prioritize alerts based on severity. You need to modify the script to only process and log alerts marked as 'Critical'. Which modification would you make to the script?
- A
Add a conditional statement to check if the 'severity' field in the alert data equals 'Critical' before processing the alert.
- B
Add a loop to iterate through all alerts and log each one regardless of severity.
- C
Add a function to change all alert severities to 'Critical' before processing them.
- D
Add a feature to archive all alerts without checking their severity.
Show answer and explanation
Correct answer: A
Explanation
To automate the security operations task effectively, the script must be modified to prioritize 'Critical' alerts as specified in the requirements. Adding a conditional statement to filter alerts based on their severity ensures the script processes only the relevant data, reducing workload and focusing on high-priority issues.
- A. Correct.
This is correct because adding a conditional statement to filter alerts based on their severity ensures that only 'Critical' alerts are processed and logged, aligning with the task requirements.
- B. Incorrect.
This is incorrect because processing all alerts without filtering does not address the requirement to prioritize 'Critical' alerts.
- C. Incorrect.
This is incorrect because modifying all alert severities to 'Critical' would lead to inaccurate data analysis and does not solve the task requirements.
- D. Incorrect.
This is incorrect because archiving all alerts without checking their severity would ignore the need to focus on 'Critical' alerts.