What advantage does incident correlation give a responder over a stream of individual alerts?
Select an answer to reveal the explanation.
Short Explanation
One failure lights up ten services. Correlation tells you which one started it.
Full Explanation
The correct choice is that related symptoms across services are presented as one event with a probable cause, so the responder starts from the likely origin rather than from a list of consequences. A single upstream failure can produce symptoms everywhere downstream, and grouping them while identifying a probable cause turns triage into a starting point. The claim that it reduces telemetry storage volume is wrong because correlation affects presentation, not ingestion. The claim that it guarantees one notification per day is wrong because notification frequency depends on what happens. The claim that it removes alert channel configuration is wrong because channels are still required to reach responders. For the exam, describe correlation as connecting symptoms to a probable cause.