SY0-701 Question 413
Single answerMonitoring and revisionA company completed a major cloud migration six months ago and enabled continuous monitoring through its SIEM. Since then, the security team has been overwhelmed by thousands of repeated alerts for approved administrative activity, and analysts recently missed a real malware infection because it was buried in the noise. The CISO asks for the fastest way to improve monitoring effectiveness without reducing visibility into actual threats. Which action should the security team take FIRST?
- A
Tune alert thresholds and correlation rules based on the current environment and documented baselines
- B
Disable alerts for all administrator accounts to reduce the number of SIEM events
- C
Increase log retention from 90 days to one year so analysts have more historical data available
- D
Perform a full vulnerability scan of all cloud workloads to identify missing patches
Show answer and explanation
Correct answer: A
Explanation
The best answer is to tune alert thresholds and correlation rules based on the current environment and documented baselines. In Security+, monitoring is not a one-time configuration task; it must be continuously reviewed and revised as systems, business processes, and infrastructure change. A major migration commonly changes traffic patterns, user behavior, service accounts, and administrative workflows, which can make legacy detections noisy or irrelevant. Best practice is to maintain baselines of normal activity, review false positives and false negatives, and update SIEM use cases accordingly. This supports effective continuous monitoring, reduces alert fatigue, and improves the chance that analysts will identify true indicators of compromise. Guidance from NIST, including concepts reflected in NIST SP 800-137 for Information Security Continuous Monitoring and NIST SP 800-61 for incident handling, emphasizes ongoing analysis, tuning, and improvement of monitoring capabilities rather than simply collecting more data or disabling important visibility.
- A. Correct.
This is correct because monitoring and revision require organizations to regularly review and adjust alerting logic as environments change. After a cloud migration, normal behavior often shifts significantly, so previously useful rules can generate excessive false positives. Updating thresholds, refining correlation rules, and aligning detections to approved administrative baselines reduces alert fatigue while preserving visibility into meaningful anomalies.
- B. Incorrect.
This is incorrect because disabling alerts for all administrator accounts would create a major blind spot. Administrative accounts are high-value targets and are frequently abused during privilege escalation and lateral movement. While approved admin activity should be baselined and tuned, completely suppressing those alerts would weaken monitoring rather than improve it.
- C. Incorrect.
This is incorrect because longer log retention can support investigations, audits, and trend analysis, but it does not address the immediate problem of excessive false positives and missed high-priority events. Retention is useful for monitoring maturity, but it is not the first corrective action when analysts are overwhelmed by noisy alerts.
- D. Incorrect.
This is incorrect because vulnerability scanning is valuable for identifying exposure, but it addresses asset weaknesses rather than the monitoring process itself. The scenario is specifically about ineffective alerting and the need to revise monitoring controls after an environmental change. A scan may uncover issues, but it will not directly reduce SIEM noise or improve alert prioritization first.