CompTIA Server+ SK0-005 Practice Question

After deploying a new SIEM, a security administrator finds that the SOC is receiving thousands of individual failed-login alerts every hour from Windows and Linux servers. The team wants to reduce the alert volume without missing a potential brute-force attack pattern. Which SIEM capability should the administrator tune first to achieve this goal?

Enable additional log-normalization parsers so every device uses a common schema
Forward authentication logs to a cold-storage data lake instead of the SIEM
Extend log retention from 30 to 90 days to provide more historical context
Create correlation rules with thresholds that group repeated login-failure events before triggering an alert

Report Issue

Answer Description

Well-tuned correlation and threshold rules allow the SIEM to combine many identical or related authentication-failure events into a single incident and generate an alert only when a defined pattern (for example, 50 failures from one IP in five minutes) is met. This directly lowers false positives and analyst fatigue while still surfacing evidence of an attack. Log normalization merely standardizes log formats and does not change how many alerts are produced. Extending retention time affects how long data is stored, not how often alarms fire. Off-loading authentication logs to cold storage would stop the SIEM from detecting or alerting on them at all, defeating the security objective.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.