Exam SPLK-3001 topic 1 question 70 discussion

C is correct Adjust correlation search sensitivity – False positives: returning results when none are actually there – False negatives: returning no results when something is expected Administering Splunk Enterprise Security page 224

By modifying the correlation search's schedule and sensitivity, you can adjust how frequently the search runs and the criteria it uses to generate notable events. This can help reduce the number of false positives by making the search conditions more stringent or reducing the frequency of the search to better match your environment. Suppression and changing status or severity do not address the root cause of false positives, while modifying the schedule and sensitivity directly impacts the detection criteria.

C is the correct answer.

C. Modify the correlation schedule and sensitivity

C should be the answer. A is not correct since we cannot suppress a high volume of notable events manually. There will be thousands of them

I also think the answer is A

Think answer should be A.