Analysts are overwhelmed by low-value firewall 'allow' alerts and miss higher-severity events. Which monitoring improvement best restores focus on true threats?
Select an answer to reveal the explanation.
Short Explanation
If the smoke alarm chirps every time someone opens a door, nobody hears a real fire—tune the noisy firewall allows down so true threats stand out. Quarantine when it matters; do not page leadership for every allow.
Full Explanation
Alert tuning and noise suppression restore SOC effectiveness when low-value firewall “allow” events drown analysts. Raising quality means adjusting thresholds, suppressing or demoting routine allows that add no investigative value, and reserving critical pages—and quarantine or containment—for genuine threats. That monitoring improvement prioritizes true positives without abandoning the ticket workflow.
Cloning every allow rule into a critical page multiplies fatigue and guarantees missed high-severity events. Disabling the SOC ticket queue so alerts never become work items severs detection from response. Forwarding every firewall log line to the mayor’s personal email creates unworkable executive spam and is not an operations design.
Exam caveat: tuning is continuous; over-suppression can hide attacks that look like allows. Document suppressions with owners and review dates. Quarantine remains a response action after prioritized detection—not a substitute for tuning.
Operational check: baseline top noisy allow signatures for a week, suppress or retier with change control, measure mean-time-to-acknowledge on remaining high/critical alerts, and sample suppressed traffic periodically for missed malice against city networks.