Study. uk . com
  1. Home
  2. All questions
  3. Question 518

CompTIA Security+ study material · question 518 of 611

A monitoring team is drowning in alerts nobody can act on. What is the underlying failure?

  1. Too few data sources
  2. Alerts are not actionable, which trains the team to ignore the channel
  3. Missing time synchronisation
  4. Insufficient log retention
Show the answer

Answer: B. Alerts are not actionable, which trains the team to ignore the channel

An alert that implies no decision is noise, and volume of noise reduces attention to the alerts that matter.

Source: OWASP Logging Cheat Sheet (OWASP) — OWASP Logging Cheat Sheet › Which events to log

Challenge yourself on this topic → Study as cards