SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Treat it as a confirmed intrusion and immediately take the portal offline.

  Why it's wrong here

  Immediate portal takedown is an aggressive incident response action reserved for confirmed intrusions with evidence of compromise. In this scenario, the WAF already blocked the payload, so no SQL injection reached the database, and the source IP matches an authorized scanner schedule. Taking the portal offline without verification would cause a denial of service to legitimate users and violates the principle of evidence-based response. The correct step is to validate the scan authorization and close the alert as expected activity.

• ✓

  Close it as expected activity after validating the scanner schedule and source IP.

  Why this is correct

  The logs align with an authorized scanner operating during a planned maintenance window, and the WAF successfully blocked the payload. After confirming the scan authorization, the alert can be documented and closed as expected activity rather than escalated as a live attack.

• ✗

  Classify it as malware because the blocked payload proves the scanner is infected.

  Why it's wrong here

  A blocked SQL injection payload does not indicate that the scanner is infected; automated vulnerability scanners intentionally send malicious strings, including SQLi, to test for weaknesses. Malware classification requires evidence of malicious executable code, persistence, or malicious behavior on a host—not the content of a network alert. The WAF blocking the payload actually confirms that the scanner is performing its intended function and that controls are effective. Labeling the scanner as infected is a logical error that would cause unnecessary and costly remediation.

• ✗

  Disable the WAF rule so the scanner can complete without generating more alerts.

  Why it's wrong here

  Disabling the WAF rule to stop alert notifications is an inappropriate response that weakens security for all users to reduce noise. Even if the scanner is authorized, the proper action is to whitelist its source IP or add an alert suppression rule, so the WAF continues to protect the portal. Removing the rule would leave the web application vulnerable to real SQL injection attempts if the scan authorization was not fully verified. Alert fatigue should be managed through tuning and exception handling, not by eliminating security controls.