Question 500
A security operations stream filters and enriches cloud events. The current environment exhibits the following problem: replayed attack events trigger duplicate incident tickets. Which action should the team take next?
Explanation
Correct Answer
Deduplicate by stable event ID before notifying the downstream system. Alert idempotency prevents repeated action for one event.
Incorrect Answers
Authentication failures should be routed to an alert destination without exporting every success. Focused streams reduce unnecessary alert volume.
A stream source sends personally identifying fields that aren't needed downstream. Data minimization should happen before broad distribution.
The event has a risk score as text and a numeric threshold compares lexically. Proper type conversion prevents false threshold results.