A SIEM alert shows a workstation making repeated outbound HTTPS connections every 15 minutes to the same cloud IP address. The host belongs to the patch-management group, and the security team suspects an approved agent may be responsible. Which two checks best validate whether this is a false positive? Select two.

Immediately isolate the workstation from the network without reviewing any other evidence.

Incorrect because isolation may be unnecessary if the alert is a known maintenance pattern. In monitoring and validation work, confirmatory evidence should be checked before disruptive containment.

Suppress every future alert from that subnet permanently.

Incorrect because permanent suppression can hide real malicious activity later. A false positive should be tuned carefully, not ignored forever without verification.

Assume the traffic is benign because it occurs at a regular interval.

Incorrect because regular intervals can also describe malware beaconing. Timing alone is not enough to prove legitimacy.

What does this SY0-701 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: Verify that the destination domain and IP match the vendor's documented update service. — To validate a false positive, the analyst should match the destination to the approved vendor service and verify the process signature and lineage against the known agent baseline. Those checks confirm whether the communication pattern and executable identity are consistent with normal patching behavior. In monitoring work, correlating multiple sources is better than relying on timing alone, because malicious beacons can also appear periodic. Why others are wrong: Immediate isolation is premature if the traffic matches an authorized update tool. Permanent suppression is unsafe because it can hide future incidents. Regular timing does not prove legitimacy, since many malware families beacon on fixed schedules. The better approach is to correlate endpoint, signature, and destination evidence before deciding.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.