CS0-003 Security Operations Practice Question
A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an external IP address on port 22. Upon investigation, the analyst finds the workstation is used by a developer who frequently transfers large files to a remote server via SCP. What is the most appropriate classification for this alert?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
False positive
The alert is triggered by legitimate administrative activity (SCP file transfer), so it is a false positive. The analyst should tune the SIEM to reduce similar alerts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
True positive
Why it's wrong here
A true positive occurs when a security tool correctly identifies and alerts on actual malicious activity. Because the SCP file transfers in this scenario are authorized, legitimate administrative actions rather than an active threat or data exfiltration attempt, classifying this alert as a true positive is incorrect.
- ✗
True negative
Why it's wrong here
A true negative represents a state where benign, authorized activity occurs on the network and the SIEM correctly refrains from triggering an alert. Since the SIEM did actively generate an alert for the SCP transfer, this scenario cannot be classified as a true negative.
- ✓
False positive
Why this is correct
A false positive occurs when a security control incorrectly flags benign, authorized activity as malicious. In this case, the SIEM generated an alert for legitimate SCP transfers, meaning the rule triggered on normal administrative behavior rather than an actual security incident.
- ✗
False negative
Why it's wrong here
A false negative occurs when an actual security threat or malicious event bypasses detection mechanisms entirely without generating any alert. This does not apply here because an alert was actively generated, and the underlying activity was benign rather than malicious.
Go deeper
Related to this question
Learn chapter
SOC Tier 1, Tier 2, and Tier 3 Analyst Roles
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
False positive
A false positive is an alert or result that indicates a security threat or vulnerability exists when in fact there is no real issue.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.