Exam CCSE-204 Topic 1 Question 62 Discussion
Actual exam question for CrowdStrike's CCSE-204 exam
Question #: 62
Topic #: 1
Question #: 62
Topic #: 1
As a Next-Gen SIEM Engineer, you are responsible for managing and tuning correlation rules to improve the detection of potential security incidents. One of your correlation rules is designed to detect multiple failed login attempts that are followed by a successful login within a short time frame.
Which step would you take to tune this correlation rule to reduce false positives while maintaining its effectiveness?
Which step would you take to tune this correlation rule to reduce false positives while maintaining its effectiveness?
Suggested Answer: B Vote an answer
The correct answer is B . The best tuning step is to exclude known trusted IP addresses so the rule still detects suspicious sequences while removing known-benign sources of repeated authentication activity.
CrowdStrike has publicly documented this tuning principle in detection content guidance, noting that to avoid false positives, organizations may want to exclude certain IP ranges, ASNs, or ISPs from a rule when those sources are expected or trusted. That directly supports the idea that adding a trusted-IP exclusion reduces noise while preserving the core detection logic.
Why the other options are incorrect:
A would usually increase noise because a larger time window captures more benign failed logins. C would also increase false positives because lowering the failed-attempt threshold makes the rule easier to trigger. D weakens the original attack logic by removing the "failed logins followed by success" sequence that makes the rule more specific and meaningful. Keeping the core sequence intact while adding exclusions for known benign sources is the most precise tuning approach.
CrowdStrike has publicly documented this tuning principle in detection content guidance, noting that to avoid false positives, organizations may want to exclude certain IP ranges, ASNs, or ISPs from a rule when those sources are expected or trusted. That directly supports the idea that adding a trusted-IP exclusion reduces noise while preserving the core detection logic.
Why the other options are incorrect:
A would usually increase noise because a larger time window captures more benign failed logins. C would also increase false positives because lowering the failed-attempt threshold makes the rule easier to trigger. D weakens the original attack logic by removing the "failed logins followed by success" sequence that makes the rule more specific and meaningful. Keeping the core sequence intact while adding exclusions for known benign sources is the most precise tuning approach.
by Ella at Jun 08, 2026, 06:09 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).