Refer to the exhibit. An engineer set the default alert condition for the network alert rule, but NOC operators report that they are getting too many false-positive alerts. Which action reduces the…

Question

Options

• AApply suppression window to the tests.
• BChange severity from Info to Critical.
• CDecrease the latency value to 50 ms.
• DUse dynamic baselines.

• A
  4% (1)
• B
  4% (1)
• C
  13% (3)
• D
  78% (18)

Explanation

Dynamic baselines (D) automatically learn what "normal" looks like for a given metric over time and adjust thresholds accordingly, so alerts only fire when behavior deviates meaningfully from the established pattern - this directly targets false positives caused by static default thresholds that can't account for normal traffic variation.

Why the distractors fail:

• A (Suppression window): Suppression silences alerts during scheduled periods (e.g., maintenance), not during normal operations - it doesn't fix false positives that occur at random times throughout the day.
• B (Change severity to Critical): Severity is just a label; it doesn't reduce the number of alerts fired. Escalating to Critical actually makes alert fatigue worse, not better.
• C (Decrease latency to 50 ms): Lowering the threshold makes the rule more sensitive, which would generate even more alerts. Reducing false positives with a static value would require increasing the threshold - but that's a blunt fix that risks missing real problems.

Memory tip: Static threshold = alarm clock that rings at the same time every day regardless of context. Dynamic baseline = a smart alarm that learns your schedule and only wakes you when something is genuinely off. When the question mentions "too many false positives" with a default condition, the answer is almost always to make the system smarter, not louder.

No community discussion yet for this question.