N10-009 Question 209
Single answerAnomaly alerting/notificationA network administrator enables anomaly-based alerting on a monitoring platform to detect unusual outbound traffic from user subnets. During the first week, the team receives dozens of alerts every morning when employees arrive and cloud applications begin syncing. Because of the alert volume, analysts are starting to ignore notifications. The administrator needs to reduce false positives without delaying notification of genuinely suspicious activity. Which action is the BEST next step?
- A
Tune the anomaly detection baseline and thresholds to account for normal business-hour traffic patterns
- B
Disable anomaly alerting during the first two hours of the business day
- C
Change all anomaly alerts from email to SMS so analysts notice them faster
- D
Lower the alert threshold further so the monitoring platform captures more traffic deviations
Show answer and explanation
Correct answer: A
Explanation
The key issue in this scenario is alert fatigue caused by false positives from anomaly-based monitoring. Best practice is to tune the system by refining baselines, thresholds, and expected patterns so the tool can distinguish legitimate traffic surges from suspicious deviations. In operational monitoring and security practice, anomaly detection is most effective after a learning period and periodic adjustment to match real usage patterns such as logon storms, patch windows, backups, or cloud sync events. Suppressing alerts entirely or merely changing the delivery method does not improve detection quality. This aligns with common guidance from network and security monitoring vendors and industry best practices: establish a normal baseline first, then configure alert thresholds and notification rules to minimize false positives while preserving visibility into meaningful events.
- A. Correct.
Correct. Anomaly alerting depends on a baseline of normal behavior. If the platform is flagging expected morning logon, synchronization, and application startup traffic as suspicious, the best next step is to tune the baseline and thresholds so normal business-hour variations are treated as expected behavior. This reduces false positives while preserving timely notification for true anomalies.
- B. Incorrect.
Incorrect. Disabling alerting during a predictable high-traffic window may reduce notifications, but it creates a monitoring blind spot. Real threats can occur during business startup periods, and suppressing all alerts at that time weakens detection rather than improving it.
- C. Incorrect.
Incorrect. Changing the notification channel does not address the root cause, which is poor alert fidelity. Analysts may receive the same excessive number of false positives by SMS instead of email, increasing alert fatigue rather than improving anomaly detection.
- D. Incorrect.
Incorrect. Lowering the threshold makes the monitoring system more sensitive, which would typically increase the number of alerts and false positives. This is the opposite of what is needed when analysts are already overwhelmed by benign anomaly notifications.