Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Isaca CRISC Exam - Topic 9 Question 72 Discussion

During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:
D) sniff the traffic using a network analyzer
A) reset the alert threshold based on peak traffic
B) analyze the traffic to minimize the false negatives
C) analyze the alerts to minimize the false positives

Isaca CRISC Exam - Topic 9 Question 72 Discussion

Actual exam question for Isaca's CRISC exam
Question #: 72
Topic #: 9
[All CRISC Questions]

During implementation of an intrusion detection system (IDS) to monitor network traffic, a high number of alerts is reported. The risk practitioner should recommend to:

Show Suggested Answer Hide Answer
Suggested Answer: D

by Isadora at Apr 24, 2024, 01:22 PM

Limited Time Offer

25%

Off

Get Premium CRISC Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Lai
7 months ago
Sniffing traffic sounds cool, but is it really necessary?
upvoted 0 times
...
Kristal
8 months ago
Wait, are we really resetting thresholds? That seems risky.
upvoted 0 times
...
Devorah
8 months ago
But shouldn't we also look at the traffic itself? Option B makes sense too.
upvoted 0 times
...
Paulina
8 months ago
Totally agree, false positives can be super annoying!
upvoted 0 times
...
Jose
8 months ago
I think option C is the way to go.
upvoted 0 times
...
Evelynn
9 months ago
Sniffing the traffic could help, but I wonder if it’s more about understanding the alerts first before diving into the traffic analysis.
upvoted 0 times
...
Rutha
9 months ago
I practiced a similar question where we had to balance false positives and false negatives. I feel like minimizing false positives is crucial here.
upvoted 0 times
...
Ceola
9 months ago
I think analyzing the alerts to reduce false positives makes sense, especially since too many alerts can lead to alert fatigue.
upvoted 0 times
...
Wilson
9 months ago
I remember studying about alert thresholds, but I'm not sure if just resetting them is the best approach.
upvoted 0 times
...
Germaine
9 months ago
Hmm, this is a tough call. I'm tempted to go with option B and analyze the traffic to minimize false negatives, but I can see the logic in option C as well. I'll have to think this through carefully.
upvoted 0 times
...
Lanie
9 months ago
Okay, let's think this through. If there are a high number of alerts, we probably want to focus on reducing false positives rather than false negatives, so I'd go with option C.
upvoted 0 times
...
Carmen
9 months ago
This seems like a tricky one. I'd want to analyze the traffic to minimize false positives, but I'm not sure if that's the best approach here.
upvoted 0 times
...
Marica
9 months ago
Resetting the alert threshold based on peak traffic sounds like a good starting point, but I'll need to consider the other options as well.
upvoted 0 times
...
Clorinda
9 months ago
Okay, I've got a strategy for this. I'll focus on analyzing the alerts to minimize false positives, since that seems like the most important priority here.
upvoted 0 times
...
Dan
9 months ago
Hmm, I'm a bit unsure about this. I'll need to review my notes on IDS implementation to figure out the best approach.
upvoted 0 times
...
Earnestine
9 months ago
This seems like a tricky one. I'll need to think carefully about the trade-offs between false positives and false negatives.
upvoted 0 times
...
Geoffrey
9 months ago
I'm a bit confused on this one. Resetting the alert threshold based on peak traffic seems like it could just mask the real issues. I think I'd lean towards analyzing the alerts to minimize false positives.
upvoted 0 times
...
Yuki
9 months ago
I'm pretty sure the answer is A, updating the major release number in the WSDL namespace name. That's a common way to indicate backwards-compatible changes in TIBCO services.
upvoted 0 times
...
Shawnta
9 months ago
The question is asking specifically about test designer, so I'll focus on that skill rating. John has the highest score there, so I think he's the best choice.
upvoted 0 times
...
Gregoria
9 months ago
Hmm, I'm not totally sure about this one. The organizational budget could also be a big factor in how the model gets implemented. I'll have to think this through a bit more.
upvoted 0 times
...
Ilona
10 months ago
What if the problem is with the authorization policy itself? Like, it doesn't allow the IT Admins to access those finance devices?
upvoted 0 times
...
Rosendo
1 year ago
Ah, the classic 'reset and hope for the best' approach. Better hope the network gremlins don't come back with a vengeance!
upvoted 0 times
Aleshia
1 year ago
Consider adjusting the sensitivity of the IDS
upvoted 0 times
...
Jess
1 year ago
Investigate the root cause of the alerts
upvoted 0 times
...
Idella
1 year ago
Ignore the alerts and hope for the best
upvoted 0 times
...
...
Ozell
1 year ago
Minimize false negatives, eh? Sounds like we need to find that sweet spot between catching all the bad guys and not drowning in a sea of alerts. Careful not to fall for the 'more is better' trap!
upvoted 0 times
Ryann
1 year ago
Maybe we can also consider implementing machine learning algorithms to help filter out the noise and improve the accuracy of alerts.
upvoted 0 times
...
Adelaide
1 year ago
I think we should focus on tuning the IDS to reduce false positives and prioritize alerts based on severity.
upvoted 0 times
...
Roy
1 year ago
Agreed, we definitely need to balance between catching real threats and not getting overwhelmed with false alarms.
upvoted 0 times
...
...
Leonardo
1 year ago
Sniff the traffic with a network analyzer? Ooh, now we're getting technical! I bet that'll give us a whole new perspective on what's going on.
upvoted 0 times
...
Dyan
1 year ago
False positives, huh? Time to put on our detective hats and figure out what's triggering all those alerts. Gotta keep that IDS running smoothly!
upvoted 0 times
Marquetta
1 year ago
It's important to regularly update the IDS signatures to ensure it's detecting the latest threats accurately.
upvoted 0 times
...
Torie
1 year ago
Maybe we should consider tuning the IDS to focus on specific types of traffic to minimize false positives.
upvoted 0 times
...
Anabel
1 year ago
We could also adjust the sensitivity levels of the IDS to reduce the number of alerts.
upvoted 0 times
...
Celestine
1 year ago
Let's start by reviewing the IDS configuration to see if there are any rules causing false positives.
upvoted 0 times
...
...
Nobuko
1 year ago
I would also consider B) analyze the traffic to minimize the false negatives. We need to ensure we're not missing any real threats.
upvoted 0 times
...
Harley
1 year ago
I agree with Rebecka. It's important to reduce false positives to focus on real threats.
upvoted 0 times
...
Rebecka
1 year ago
I think the answer is C) analyze the alerts to minimize the false positives.
upvoted 0 times
...
Hortencia
1 year ago
Resetting the alert threshold? Sounds like a quick fix, but I'm not sure that's the best long-term solution. Gotta dig deeper and analyze that traffic!
upvoted 0 times
Catina
1 year ago
User 4: Sniffing the traffic using a network analyzer could also help us understand the root cause of the high number of alerts.
upvoted 0 times
...
Rasheeda
1 year ago
User 3: Yeah, analyzing the alerts to minimize false positives is crucial for effective intrusion detection.
upvoted 0 times
...
Coleen
1 year ago
User 2: Definitely, we need to make sure we're not missing any real threats by setting the threshold too high.
upvoted 0 times
...
Eden
1 year ago
User 1: I agree, analyzing the traffic is key to minimizing false negatives.
upvoted 0 times
...
Zita
1 year ago
User 2: Zita is right, we should analyze the traffic to minimize false negatives.
upvoted 0 times
...
Suzan
1 year ago
User 1: Resetting the alert threshold? Sounds like a quick fix, but I'm not sure that's the best long-term solution.
upvoted 0 times
...
...

Save Cancel