A third-party assessment of a recent incident determined that the incident response team spent too long trying to get the scope needed for the incident timeline and too much time was spent searching…

The correct answer is C. Detection tuning. Detection tuning helps reduce false positives and ensures that alerts are relevant and actionable. By refining detection rules, the team can more quickly identify the true scope of an incident and respond efficiently.

Submitted by layla.eg· Mar 6, 2026Incident Response and Management

Question

A third-party assessment of a recent incident determined that the incident response team spent too long trying to get the scope needed for the incident timeline and too much time was spent searching for false positives. Which of the following should the team work on first?

Options

APlaybook edits
BTicket system automation
CDetection tuning
DStandard operating procedure refinement

How the community answered

(33 responses)

A
30% (10)
B
6% (2)
C
52% (17)
D
12% (4)

Explanation

Detection tuning helps reduce false positives and ensures that alerts are relevant and actionable. By refining detection rules, the team can more quickly identify the true scope of an incident and respond efficiently.

Topics

#incident response#false positives#detection tuning#MTTR

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice