ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Noise reduction keeps monitoring focused on actionable events without losing the ability to detect real threats. GuardDuty filters with archive rules let analysts suppress findings that match specific criteria (for example, a port-scan coming from known scanner IP ranges). The finding is still stored and can be reinstated later, but it is no longer surfaced to the SOC or forwarded to the SIEM, reducing noise. Disabling GuardDuty removes critical detections entirely, defeating the purpose. Changing aggregation frequency does not stop the findings from appearing; it only groups them. Deleting findings each day hides data permanently and eliminates the ability to review historical patterns, violating evidentiary and forensic best practices.