CISSP Practice Question (Domain 7: Security Operations)

An organization deploys an AI based alerting system that automatically suppresses repeated low severity security alerts to reduce analyst fatigue. During a later breach investigation, leadership questions whether suppressed alerts should have been retained.

What is the MOST appropriate governance concern the security manager should address FIRST?

A. Accuracy and tuning thresholds of the AI detection model

B. Alignment of alert suppression with evidence retention requirements

C. Analyst training on interpreting AI generated alerts

D. Cost effectiveness of the AI system compared to manual review

12 comments