[&] What is alert noise in the context of SOC monitoring?
- Alerts that require immediate response
- Alerts that are irrelevant or false positives -- Correct
- Alerts that are always handled by Tier 2
- Alerts that are always critical

[&] When should an alert be escalated based on asset criticality?
- When triggered during business hours
- Involving high-value or business-critical systems -- Correct
- If it involves a non-essential service
- Only in public-facing servers

[&] Why is reducing alert noise critical in a SOC?
- To increase the number of false positives
- To ensure all alerts are escalated to Tier 3
- To keep analysts focused on genuine threats -- Correct
- To ensure alerts fit within service level agreements

[&] Which type of alert is considered the most dangerous due to its nature?
- False Positive
- True Positive
- True Negative
- False Negative -- Correct

[&] How should a SOC handle alerts with high false positive rates?
- Treat them as true negatives
- Escalate them immediately
- Ignore them during triage
- Adjust detection rules or apply suppression filters -- Correct